CVE-2019-1003071: High severity octopus deploy vulnerability
Jenkins Octopus Deploy Plugin stores credentials unencrypted in its global configuration file hudson.plugins.octopusdeploy.OctopusDeployPlugin.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system.
Other sources
Jenkins OctopusDeploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-1003071?
CVE-2019-1003071 is classified as a medium severity vulnerability due to the potential exposure of unencrypted credentials.
How do I fix CVE-2019-1003071?
To fix CVE-2019-1003071, upgrade the Jenkins Octopus Deploy Plugin to version 1.9.0 or later.
What is affected by CVE-2019-1003071?
CVE-2019-1003071 affects the Jenkins Octopus Deploy Plugin versions up to and including 1.8.1.
What type of information is vulnerable in CVE-2019-1003071?
CVE-2019-1003071 exposes unencrypted credentials stored in the Jenkins global configuration file.
Who can exploit CVE-2019-1003071?
Users with access to the Jenkins controller file system can exploit CVE-2019-1003071.