Vulnerability Description
Jenkins Azure PublisherSettings Credentials Plugin 1.2 and earlier stored credentials unencrypted in the credentials.xml file on the Jenkins master where they could be viewed by users with access to the master file system.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Azure Publishersettings Credentials | <= 1.2 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/108045Third Party AdvisoryVDB Entry
- https://jenkins.io/security/advisory/2019-04-17/#SECURITY-844Vendor Advisory
- http://www.securityfocus.com/bid/108045Third Party AdvisoryVDB Entry
- https://jenkins.io/security/advisory/2019-04-17/#SECURITY-844Vendor Advisory
FAQ
What is CVE-2019-10303?
CVE-2019-10303 is a vulnerability with a CVSS score of 8.8 (HIGH). Jenkins Azure PublisherSettings Credentials Plugin 1.2 and earlier stored credentials unencrypted in the credentials.xml file on the Jenkins master where they could be viewed by users with access to t...
How severe is CVE-2019-10303?
CVE-2019-10303 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-10303?
Check the references section above for vendor advisories and patch information. Affected products include: Jenkins Azure Publishersettings Credentials.