PT-2019-14723 · Jenkins · Jenkins Sctmexecutor Plugin+1

James Holderness · Published 2019-12-17 · Updated 2023-10-25 · CVE-2019-16568

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins SCTMExecutor Plugin versions 2.2 and earlier

Description The issue concerns the transmission of previously configured service credentials in plain text. This occurs in two areas: as part of the global configuration and within individual jobs' configurations.

Recommendations For Jenkins SCTMExecutor Plugin versions 2.2 and earlier, update to a version later than 2.2 to resolve the issue.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2019-16568

GHSA-RXPH-CQ38-GM3G

Affected Products

Jenkins

Jenkins Sctmexecutor Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-16568 · Security Note
• https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1521 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-16568 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rxph-cq38-gm3g · Vendor Advisory
• https://github.com/jenkins-infra/update-center2/pull/324 · Note
• http://openwall.com/lists/oss-security/2019/12/17/1 · Note