Unencrypted Credentials Exposure in Jenkins ElasticBox CI Plugin
CVE-2019-10450

3.3LOW

Key Information:

Vendor
Jenkins
Status
Jenkins Elasticbox Ci Plugin
Vendor
CVE Published:
16 October 2019

Summary

The Jenkins ElasticBox CI Plugin is susceptible to a security vulnerability where it stores user credentials in an unencrypted format within the global config.xml file on the Jenkins master server. This could allow unauthorized users with access to the file system of the Jenkins master to view sensitive information. It is essential for users to update to the latest version of the plugin to mitigate this risk and protect sensitive data.

Affected Version(s)

Jenkins ElasticBox CI Plugin 5.0.1 and earlier

References

https://jenkins.io/security/advisory/2019-10-16/#SECURITY...
x_refsource_CONFIRM

CVSS V3.1

Score:
3.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.