Unencrypted Credential Storage in Jenkins Bitbucket OAuth Plugin
CVE-2019-10460

7.8HIGH

Key Information:

Vendor
Jenkins
Status
Jenkins Bitbucket Oauth Plugin
Vendor
CVE Published:
23 October 2019

Summary

The Jenkins Bitbucket OAuth Plugin versions up to and including 0.9 suffered from a serious issue where sensitive credentials were stored unencrypted in the global config.xml configuration file on the Jenkins master. This vulnerability allowed any user with access to the master file system to view these credentials, potentially leading to unauthorized access to Bitbucket repositories and other associated resources. It is crucial for users of this plugin to be aware of this risk and take necessary measures to secure their systems.

Affected Version(s)

Jenkins Bitbucket OAuth Plugin 0.9 and earlier

References

https://jenkins.io/security/advisory/2019-10-23/#SECURITY...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2019/10/23/2
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.