Unencrypted Credential Storage in Jenkins Beaker Builder Plugin
CVE-2019-10398

5.5MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Beaker Builder Plugin
Vendor
CVE Published:
12 September 2019

Summary

The Beaker Builder Plugin for Jenkins improperly stores user credentials in an unencrypted format within the global configuration file on the Jenkins master. This security oversight allows users with filesystem access to the Jenkins master to view sensitive credentials, potentially leading to unauthorized access or data breaches. It is crucial for system administrators to review their configurations and implement secure credential management practices to mitigate such vulnerabilities.

Affected Version(s)

Jenkins Beaker Builder Plugin 1.9 and earlier

References

http://www.openwall.com/lists/oss-security/2019/09/12/2
mailing-listx_refsource_MLIST
https://jenkins.io/security/advisory/2019-09-12/#SECURITY...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.