Insufficiently Protected Credentials in Jenkins Repository Connector Plugin by Jenkins

CVE-2019-1003038

Summary

A vulnerability exists in the Jenkins Repository Connector Plugin that allows an attacker with local file system access or control of a Jenkins administrator's web browser to access sensitive password information stored in the plugin's configuration. Specifically, components such as ArtifactDeployer.java, Repository.java, and UserPwd.java have inadequate safeguards, which could lead to unauthorized retrieval of credentials. This highlights the importance of securing sensitive information within plugin settings and the potential use of malicious browser extensions.

References