PT-2019-11827

CVE-2019-10433

Published

2019-10-01

Updated

2023-10-25

Description by

CVSS 3.1

3.3

Low

MetricsAV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Dingding Plugin (affected versions not specified)

Description The issue concerns the storage of credentials in an unencrypted manner in job config.xml files on the Jenkins master. These credentials can be accessed by users with Extended Read permission or those who have access to the master file system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Impacts

Researchers

David Fiser

Vendors

Affected products

Weakness enumeration

CWE-256: Plaintext Storage of a Password

CWE-312: Cleartext Storage of Sensitive Information

Related identifiers

CVE-2019-10433

GHSA-XG8P-CP7F-CPHX