Unencrypted Credential Storage in Jenkins Beaker Builder Plugin
CVE-2019-10398

5.5MEDIUM

Key Information:

Vendor

Jenkins
Status
Jenkins Beaker Builder Plugin
Vendor
CVE Published:
12 September 2019

What is CVE-2019-10398?

The Beaker Builder Plugin for Jenkins improperly stores user credentials in an unencrypted format within the global configuration file on the Jenkins master. This security oversight allows users with filesystem access to the Jenkins master to view sensitive credentials, potentially leading to unauthorized access or data breaches. It is crucial for system administrators to review their configurations and implement secure credential management practices to mitigate such vulnerabilities.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Jenkins Beaker Builder Plugin 1.9 and earlier

References

http://www.openwall.com/lists/oss-security/2019/09/12/2
mailing-listx_refsource_MLIST
https://jenkins.io/security/advisory/2019-09-12/#SECURITY...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.