PT-2019-11792 · Jenkins · Jenkins Beaker Builder Plugin+1

James Holderness · Published 2019-09-12 · Updated 2023-10-25 · CVE-2019-10398

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Beaker Builder Plugin versions 1.9 and earlier

Description The issue concerns the storage of credentials in the Jenkins Beaker Builder Plugin. Specifically, the plugin stored credentials unencrypted in its global configuration file on the Jenkins master, allowing users with access to the master file system to view them. This includes the Beaker password, which was stored in plain text on the Jenkins controller and could be accessed by users with file system access to the controller.

Recommendations For Jenkins Beaker Builder Plugin versions 1.9 and earlier, update the plugin to a version that stores credentials encrypted, as the updated Beaker builder Plugin now stores these credentials securely.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2019-10398

GHSA-9678-5F6F-WP3F

Affected Products

Jenkins

Jenkins Beaker Builder Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-10398 · Security Note
• https://osv.dev/vulnerability/GHSA-9678-5f6f-wp3f · Vendor Advisory
• https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1545 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10398 · Vendor Advisory
• https://github.com/jenkinsci/beaker-builder-plugin/commit/be0101f3541a5d2c28cf226c8b2e55cd4cfc94da · Note
• http://openwall.com/lists/oss-security/2019/09/12/2 · Note