PT-2019-11331 · Jenkins · Jenkins Repository Connector Plugin+1

Viktor Gazdag · Published 2019-03-08 · Updated 2023-10-25 · CVE-2019-1003038

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins Repository Connector Plugin versions 1.2.4 and earlier

Description: The issue allows an attacker with local file system access or control of a Jenkins administrator's web browser to retrieve the password stored in the plugin configuration. This is due to insufficient protection of credentials in the plugin. The plugin stored the username and password unencrypted in its global configuration file on the Jenkins controller, allowing users with access to the Jenkins controller file system to view the password.

Recommendations: For Jenkins Repository Connector Plugin versions 1.2.4 and earlier, update the plugin to a version that stores the password encrypted in the configuration files on disk and no longer transfers it to users viewing the configuration form in plain text. As a temporary workaround, consider restricting access to the Jenkins controller file system to minimize the risk of exploitation.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2019-1003038

GHSA-99JC-V8PQ-6QM4

Affected Products

Jenkins

Jenkins Repository Connector Plugin

References · 6

• https://jenkins.io/security/advisory/2019-03-06/#SECURITY-958 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1003038 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1003038 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-99jc-v8pq-6qm4 · Vendor Advisory
• http://securityfocus.com/bid/107476 · Note
• https://web.archive.org/web/20200227084009/http://securityfocus.com/bid/107476 · Note