PT-2019-12251 · Cloudbees · Cloudbees Jenkins Operations Center

Binary1985 + 1 · Published 2019-04-19 · Updated 2020-08-24 · CVE-2019-11350

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CloudBees Jenkins Operations Center version 2.150.2.3

Description The issue allows cleartext password storage and retrieval via the proxy configuration page when an expired trial license exists.

Recommendations For CloudBees Jenkins Operations Center version 2.150.2.3, consider removing or updating the expired trial license to prevent cleartext password storage and retrieval. As a temporary workaround, restrict access to the proxy configuration page to minimize the risk of exploitation.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2019-11350

Affected Products

Cloudbees Jenkins Operations Center

References · 5

• https://osv.dev/vulnerability/CVE-2019-11350 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11350 · Security Note
• https://github.com/binary1985/VulnerabilityDisclosure/blob/master/CloudBees%20Jenkins%20Operations%20Center%20Password%20Disclosure · Note
• https://release-notes.cloudbees.com/release/21/8.18 · Note
• https://raw.githubusercontent.com/binary1985/VulnerabilityDisclosure/master/CloudBees%20Jenkins%20Operations%20Center%20Password%20Disclosure · Note