CVE-2019-10277
First published: Thu Apr 04 2019(Updated: )
Jenkins StarTeam Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Starteam | ||
| maven/hudson.plugins:starteam | <=0.6.13 | |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-10277?
CVE-2019-10277 is classified as a high severity vulnerability due to the potential exposure of unencrypted credentials.
How do I fix CVE-2019-10277?
To fix CVE-2019-10277, you should upgrade the Jenkins StarTeam Plugin to a version that no longer stores credentials unencrypted.
Who is affected by CVE-2019-10277?
CVE-2019-10277 affects all users of the Jenkins StarTeam Plugin versions up to and including 0.6.13.
What kind of data is exposed in CVE-2019-10277?
CVE-2019-10277 exposes user credentials stored in the job config.xml files on the Jenkins master.
What permissions allow access to the credentials in CVE-2019-10277?
Users with Extended Read permission or direct access to the Jenkins master file system can view the unencrypted credentials affected by CVE-2019-10277.
- collector/nvd-index
- collector/nvd-api
- agent/weakness
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-gvhp-v4m2-3rwf
- alias/CVE-2019-10277
- agent/software-canonical-lookup
- agent/references
- agent/severity
- agent/description
- agent/author
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/trending
- agent/tags
- agent/source
- vendor/jenkins
- canonical/jenkins starteam
- package-manager/maven