CVE-2019-10280: High severity jenkins assembla auth vulnerability
Jenkins Assembla Auth Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-10280?
CVE-2019-10280 is a vulnerability in Jenkins Assembla Auth Plugin that allows unencrypted storage of credentials in a configuration file, making them accessible to unauthorized users.
How does CVE-2019-10280 affect Jenkins Assembla Auth Plugin?
CVE-2019-10280 affects Jenkins Assembla Auth Plugin by storing credentials unencrypted in the global config.xml file on the Jenkins master, making them viewable by users with access to the file system.
What is the severity of CVE-2019-10280?
CVE-2019-10280 has a severity rating of 8.8 (High) out of 10.
How can I fix CVE-2019-10280?
To fix CVE-2019-10280, update Jenkins Assembla Auth Plugin to the latest version where the vulnerability is patched.
Are there any references for CVE-2019-10280?
Yes, you can find references for CVE-2019-10280 at the following URLs: [http://www.openwall.com/lists/oss-security/2019/04/12/2](http://www.openwall.com/lists/oss-security/2019/04/12/2), [http://www.securityfocus.com/bid/107790](http://www.securityfocus.com/bid/107790), [https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1093](https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1093).