CVE-2019-10413

Name of the Vulnerable Software and Affected Versions Jenkins Data Theorem: CI/CD Plugin versions 1.3 and earlier

Description The issue concerns the storage of credentials in an unencrypted manner in job config.xml files on the Jenkins master. This allows users with Extended Read permission or access to the master file system to view these credentials. Specifically, the Data Theorem Mobile Security: CI/CD Plugin stored a proxy password unencrypted, which could be accessed by users with the aforementioned permissions.

Recommendations For Jenkins Data Theorem: CI/CD Plugin versions 1.3 and earlier, save the job configuration to overwrite existing plain text proxy passwords with encrypted ones, ensuring the proxy password is stored encrypted going forward.