PT-2019-11791 · Jenkins · Jenkins Aqua Security Serverless Scanner Plugin+1

James Holderness · CVE-2019-10397 · Publicado 2019-09-12 · Atualizado 2023-10-25

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Aqua Security Serverless Scanner Plugin versions 1.0.4 and earlier

Description The issue involves the transmission of configured passwords in plain text as part of job configuration forms, potentially leading to their exposure.

Recommendations For Jenkins Aqua Security Serverless Scanner Plugin versions 1.0.4 and earlier, update to a version later than 1.0.4 to prevent the exposure of configured passwords.

Correção

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

Identificadores relacionados

CVE-2019-10397

GHSA-56GJ-927P-MFPH

Produtos afetados

Jenkins

Jenkins Aqua Security Serverless Scanner Plugin

Referências · 5

• https://jenkins.io/security/advisory/2019-09-12/#SECURTY-1509 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2019/09/12/2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10397 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-10397 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-56gj-927p-mfph · Aviso do Fabricante