CVE-2019-1003056: High severity jenkins websphere deployer vulnerability
Jenkins WebSphere Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
Other sources
Jenkins WebSphere Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-1003056?
CVE-2019-1003056 is a vulnerability in the Jenkins WebSphere Deployer Plugin that allows credentials stored in job `config.xml` files to be viewed by unauthorized users.
What is the severity of CVE-2019-1003056?
CVE-2019-1003056 has a severity rating of 8.8, which is considered high.
How does CVE-2019-1003056 affect Jenkins?
CVE-2019-1003056 affects Jenkins by storing credentials in job `config.xml` files on the Jenkins controller, which can be accessed by unauthorized users.
Which software is affected by CVE-2019-1003056?
Jenkins WebSphere Deployer Plugin version 1.6.1 is affected by CVE-2019-1003056.
How can CVE-2019-1003056 be fixed?
To fix CVE-2019-1003056, it is recommended to upgrade the Jenkins WebSphere Deployer Plugin to a version that resolves the vulnerability.