PT-2019-11808 · Jenkins · Jenkins Git Changelog Plugin+1

James Holderness · Published 2019-09-25 · Updated 2023-10-25 · CVE-2019-10414

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Git Changelog Plugin versions 2.17 and earlier

Description The issue concerns the storage of credentials in an unencrypted manner in job config.xml files on the Jenkins master or controller. Specifically, MediaWiki and Jira passwords were stored in plain text, making them accessible to users with Extended Read permission or those with access to the master or controller file system.

Recommendations For Jenkins Git Changelog Plugin versions 2.17 and earlier, save the job configuration to overwrite existing plain text passwords with encrypted ones.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2019-10414

GHSA-H27G-72MH-9M33

Affected Products

Jenkins

Jenkins Git Changelog Plugin

References · 7

• https://osv.dev/vulnerability/CVE-2019-10414 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10414 · Security Note
• https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1574 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h27g-72mh-9m33 · Vendor Advisory
• https://github.com/jenkinsci/git-changelog-plugin · Note
• https://github.com/jenkinsci/git-changelog-plugin/commit/356243aa6d3f6ad60f057e7567a3466910618441 · Note
• http://openwall.com/lists/oss-security/2019/09/25/3 · Note