CVE-2019-10297: High severity ibm sametime vulnerability
Jenkins Sametime Plugin stores credentials unencrypted in its global configuration file hudson.plugins.sametime.im.transport.SametimePublisher.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system.
Other sources
Jenkins Sametime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10297?
CVE-2019-10297 has a severity rating that indicates potential exposure of unencrypted credentials stored by the Jenkins Sametime Plugin.
How do I fix CVE-2019-10297?
To fix CVE-2019-10297, upgrade the Jenkins Sametime Plugin to a version above 0.4 to ensure credentials are encrypted.
What are the risks associated with CVE-2019-10297?
The risks associated with CVE-2019-10297 include unauthorized access to sensitive credentials by users who can access the Jenkins controller file system.
Which versions of the Jenkins Sametime Plugin are affected by CVE-2019-10297?
CVE-2019-10297 affects all versions of the Jenkins Sametime Plugin up to and including version 0.4.
Is CVE-2019-10297 specific to certain operating systems?
CVE-2019-10297 is not specific to any operating systems; it affects the Jenkins Sametime Plugin regardless of the OS used.