PT-2019-11828 · Jenkins · Jenkins Ldap Email Plugin+1

James Holderness · CVE-2019-10434 · Published 2019-10-01 · Updated 2023-10-25

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins LDAP Email Plugin (affected versions not specified)

Description The issue concerns the transmission of configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-256

CWE-319

Related Identifiers

CVE-2019-10434

GHSA-53JW-4GWH-M8CM

Affected Products

Jenkins

Jenkins Ldap Email Plugin

References · 6

• https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1515 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10434 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10434 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-53jw-4gwh-m8cm · Vendor Advisory
• https://github.com/jenkinsci/ldapemail-plugin · Note
• http://openwall.com/lists/oss-security/2019/10/01/2 · Note