PT-2019-11806 · Jenkins · Jenkins Inedo Proget Plugin+1

James Holderness · Published 2019-09-25 · Updated 2023-10-25 · CVE-2019-10412

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Inedo ProGet Plugin versions 1.2 and earlier

Description The issue concerns the transmission of configured credentials in plain text as part of the global Jenkins configuration form, potentially leading to their exposure. Specifically, the Inedo ProGet Plugin stores a service password in its global Jenkins configuration, which, although stored encrypted on disk, was previously transmitted in plain text. This could result in password exposure through browser extensions, cross-site scripting vulnerabilities, and similar situations.

Recommendations For Jenkins Inedo ProGet Plugin versions 1.2 and earlier, update the plugin to a version that encrypts the password transmitted to administrators viewing the global configuration form.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2019-10412

GHSA-F6G8-PXVP-9328

Affected Products

Jenkins

Jenkins Inedo Proget Plugin

References · 6

• https://osv.dev/vulnerability/GHSA-f6g8-pxvp-9328 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10412 · Security Note
• https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1514 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10412 · Vendor Advisory
• https://github.com/jenkinsci/inedo-proget-plugin/commit/9634846c65f204c2b54237674b2cecf66d5d5fdb · Note
• http://openwall.com/lists/oss-security/2019/09/25/3 · Note