PT-2019-11785 · Ibm+1 · Jenkins Ibm Application Security On Cloud Plugin+1

James Holderness · Published 2019-08-28 · Updated 2023-10-25 · CVE-2019-10391

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins IBM Application Security on Cloud Plugin versions 1.2.4 and earlier

Description The issue is related to the transmission of configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure. The plugin has been deprecated.

Recommendations For Jenkins IBM Application Security on Cloud Plugin versions 1.2.4 and earlier, consider disabling the plugin until a fix is available or an alternative solution is implemented. Restrict access to job configuration forms to minimize the risk of password exposure.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2019-10391

GHSA-65RJ-CGRP-G65W

Affected Products

Jenkins

Jenkins Ibm Application Security On Cloud Plugin

References · 5

• https://jenkins.io/security/advisory/2019-08-28/#SECURITY-1512 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10391 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10391 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-65rj-cgrp-g65w · Vendor Advisory
• http://openwall.com/lists/oss-security/2019/08/28/4 · Note