CVE-2019-10280
First published: Thu Apr 04 2019(Updated: )
Jenkins Assembla Auth Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Assembla Auth | ||
| maven/org.jenkins-ci.plugins:assembla-auth | <=1.11 | 1.13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-10280?
CVE-2019-10280 is a vulnerability in Jenkins Assembla Auth Plugin that allows unencrypted storage of credentials in a configuration file, making them accessible to unauthorized users.
How does CVE-2019-10280 affect Jenkins Assembla Auth Plugin?
CVE-2019-10280 affects Jenkins Assembla Auth Plugin by storing credentials unencrypted in the global config.xml file on the Jenkins master, making them viewable by users with access to the file system.
What is the severity of CVE-2019-10280?
CVE-2019-10280 has a severity rating of 8.8 (High) out of 10.
How can I fix CVE-2019-10280?
To fix CVE-2019-10280, update Jenkins Assembla Auth Plugin to the latest version where the vulnerability is patched.
Are there any references for CVE-2019-10280?
Yes, you can find references for CVE-2019-10280 at the following URLs: [http://www.openwall.com/lists/oss-security/2019/04/12/2](http://www.openwall.com/lists/oss-security/2019/04/12/2), [http://www.securityfocus.com/bid/107790](http://www.securityfocus.com/bid/107790), [https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1093](https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1093).
- collector/nvd-index
- collector/nvd-api
- agent/weakness
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-wmq3-24jm-m8xh
- alias/CVE-2019-10280
- agent/software-canonical-lookup
- agent/references
- agent/severity
- agent/last-modified-date
- agent/description
- agent/author
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/jenkins
- canonical/jenkins assembla auth
- package-manager/maven