PT-2019-11828 · Jenkins · Jenkins Ldap Email Plugin+1

James Holderness · CVE-2019-10434 · Publicado 2019-10-01 · Atualizado 2023-10-25

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins LDAP Email Plugin (affected versions not specified)

Description The issue concerns the transmission of configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-256

CWE-319

Identificadores relacionados

CVE-2019-10434

GHSA-53JW-4GWH-M8CM

Produtos afetados

Jenkins

Jenkins Ldap Email Plugin

Referências · 6

• https://github.com/jenkinsci/ldapemail-plugin · Nota
• https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1515 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10434 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-10434 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-53jw-4gwh-m8cm · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2019/10/01/2 · Nota