PT-2019-11807 · Jenkins · Jenkins Data Theorem: Ci/Cd Plugin+1

James Holderness · Published 2019-09-25 · Updated 2023-10-25 · CVE-2019-10413

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Data Theorem: CI/CD Plugin versions 1.3 and earlier

Description The issue concerns the storage of credentials in an unencrypted manner in job config.xml files on the Jenkins master. This allows users with Extended Read permission or access to the master file system to view these credentials. Specifically, the Data Theorem Mobile Security: CI/CD Plugin stored a proxy password unencrypted, which could be accessed by users with the aforementioned permissions.

Recommendations For Jenkins Data Theorem: CI/CD Plugin versions 1.3 and earlier, save the job configuration to overwrite existing plain text proxy passwords with encrypted ones, ensuring the proxy password is stored encrypted going forward.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2019-10413

GHSA-JJMV-6FV4-85VF

Affected Products

Jenkins

Jenkins Data Theorem: Ci/Cd Plugin

References · 5

• https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1557 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10413 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10413 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jjmv-6fv4-85vf · Vendor Advisory
• http://openwall.com/lists/oss-security/2019/09/25/3 · Note