CVE-2019-1003068: High severity vmware vrealize automation vulnerability
Jenkins VMware vRealize Automation Plugin stores credentials unencrypted in job config.xml files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
Other sources
Jenkins VMware vRealize Automation Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-1003068?
CVE-2019-1003068 is classified as a medium severity vulnerability.
How do I fix CVE-2019-1003068?
To fix CVE-2019-1003068, upgrade to a version of the Jenkins VMware vRealize Automation Plugin that is later than 1.2.3.
Who is affected by CVE-2019-1003068?
Users of Jenkins with the VMware vRealize Automation Plugin version 1.2.3 or earlier are affected by CVE-2019-1003068.
What type of information is exposed in CVE-2019-1003068?
CVE-2019-1003068 exposes unencrypted credentials stored in job config.xml files on the Jenkins controller.
What permissions are needed to exploit CVE-2019-1003068?
Exploitation of CVE-2019-1003068 requires users to have Extended Read permission or access to the Jenkins controller file system.