CVE-2019-10412

Name of the Vulnerable Software and Affected Versions Jenkins Inedo ProGet Plugin versions 1.2 and earlier

Description The issue concerns the transmission of configured credentials in plain text as part of the global Jenkins configuration form, potentially leading to their exposure. Specifically, the Inedo ProGet Plugin stores a service password in its global Jenkins configuration, which, although stored encrypted on disk, was previously transmitted in plain text. This could result in password exposure through browser extensions, cross-site scripting vulnerabilities, and similar situations.

Recommendations For Jenkins Inedo ProGet Plugin versions 1.2 and earlier, update the plugin to a version that encrypts the password transmitted to administrators viewing the global configuration form.