CVE-2019-10430

Published: Sep 25, 2019Modified: Nov 21, 2024

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

Jenkins NeuVector Vulnerability Scanner Plugin 1.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.

Affected (1)

Products: Jenkins: Neuvector Vulnerability Scanner

Jenkins

1 product

Neuvector Vulnerability Scanner

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jenkins Neuvector Vulnerability Scanner	Up to 1.5

Related CWEs

CWE-312

Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

References (4)

http://www.openwall.com/lists/oss-security/2019/09/25/3

Source: jenkinsci-cert@googlegroups.com

Mailing List

https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1504

Source: jenkinsci-cert@googlegroups.com

Vendor Advisory

http://www.openwall.com/lists/oss-security/2019/09/25/3

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1504

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.