PT-2019-11720 · Jenkins · Jenkins Azure Ad Plugin+1

Mark Combellack · Published 2019-04-30 · Updated 2023-10-25 · CVE-2019-10318

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Azure AD Plugin versions 0.3.3 and earlier

Description The issue concerns the storage of the client secret in the global config.xml configuration file on the Jenkins master or controller. This secret was stored unencrypted, allowing users with access to the master or controller file system to view the credentials.

Recommendations For Jenkins Azure AD Plugin versions 0.3.3 and earlier, update the plugin to a version that stores the client secret encrypted, as the updated Azure AD Plugin now includes this security enhancement.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2019-10318

GHSA-JCWJ-J574-8J2C

Affected Products

Jenkins

Jenkins Azure Ad Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2019-10318 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10318 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jcwj-j574-8j2c · Vendor Advisory
• https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1390 · Vendor Advisory
• https://github.com/jenkinsci/azure-ad-plugin/commit/70983d1a6528847ccd6e7f124450c578c42d194f · Note
• http://openwall.com/lists/oss-security/2019/04/30/5 · Note
• https://web.archive.org/web/20200227073756/http://securityfocus.com/bid/108159 · Note
• http://securityfocus.com/bid/108159 · Note