1. CVE-Search
  2. CVE-2019-10351
ID CVE-2019-10351
Summary Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
References
Vulnerable Configurations
  • cpe:2.3:a:jenkins:caliper_ci:-:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:caliper_ci:-:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:caliper_ci:2.3:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:caliper_ci:2.3:*:*:*:*:jenkins:*:*
CVSS
Base: 4.0 (as of 25-10-2023 - 18:16)
Impact:
Exploitability:
CWE CWE-312
CAPEC
  • Retrieve Embedded Sensitive Data
    An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.
Access
VectorComplexityAuthentication
NETWORK LOW SINGLE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:N/AC:L/Au:S/C:P/I:N/A:N
refmap via4
bid 109156
confirm https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1437
misc https://www.zerodayinitiative.com/advisories/ZDI-19-836/
mlist [oss-security] 20190711 Multiple vulnerabilities in Jenkins plugins
Last major update 25-10-2023 - 18:16
Published 11-07-2019 - 14:15
Last modified 25-10-2023 - 18:16
Back to Top