PT-2019-11829 · Sourcegear+1 · Jenkins Sourcegear Vault Plugin+1

James Holderness · Published 2019-10-01 · Updated 2023-10-25 · CVE-2019-10435

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins SourceGear Vault Plugin (affected versions not specified)

Description The Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure. There are no patches available for this issue, and the plugin is unmaintained.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2019-10435

GHSA-JRMF-XHR6-3428

Affected Products

Jenkins

Jenkins Sourcegear Vault Plugin

References · 6

• https://osv.dev/vulnerability/GHSA-jrmf-xhr6-3428 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10435 · Security Note
• https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1524 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10435 · Vendor Advisory
• https://github.com/jenkinsci/vault-scm-plugin · Note
• http://openwall.com/lists/oss-security/2019/10/01/2 · Note