CVE-2019-10351: Jenkins Caliper CI Cleartext Storage of Credentials Information Disclosure Vulnerability
First published: Thu Jul 11 2019(Updated: )
Jenkins Caliper CI Plugin stores credentials unencrypted in job `config.xml` files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. As of publication of this advisory, there is no fix.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Caliper CI | ||
| maven/com.brianfromoregon:caliper-ci | <=2.3 | |
| Jenkins Caliper Ci Jenkins | <=2.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://jenkins.io/security/advisory/2019-07-11/
- https://www.zerodayinitiative.com/advisories/ZDI-19-836/
- https://nvd.nist.gov/vuln/detail/CVE-2019-10351
- https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1437
- http://www.openwall.com/lists/oss-security/2019/07/11/4
- https://github.com/advisories/GHSA-3frc-879c-j9h5 (Advisory)
- http://www.securityfocus.com/bid/109156
Frequently Asked Questions
What is the severity of CVE-2019-10351?
CVE-2019-10351 has a moderate severity due to the exposure of unencrypted credentials.
How do I fix CVE-2019-10351?
As of now, there is no fix available for CVE-2019-10351.
Who is affected by CVE-2019-10351?
CVE-2019-10351 affects users of the Jenkins Caliper CI Plugin version up to 2.3.
What are the consequences of CVE-2019-10351?
The consequence of CVE-2019-10351 is that sensitive credentials may be exposed to users with Extended Read permission.
What mitigations are available for CVE-2019-10351?
To mitigate CVE-2019-10351, restrict access to Jenkins controller file systems and limit Extended Read permissions.
- collector/github-advisory-latest
- alias/GHSA-3frc-879c-j9h5
- alias/CVE-2019-10351
- collector/github-advisory
- agent/type
- agent/weakness
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-cve
- collector/nvd-index
- agent/author
- agent/references
- agent/severity
- agent/title
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-19-836
- alias/ZDI-CAN-8883
- agent/software-canonical-lookup
- agent/event
- agent/trending
- agent/tags
- agent/source
- package-manager/maven
- vendor/jenkins
- canonical/jenkins caliper ci jenkins
- version/jenkins caliper ci jenkins/2.3
- canonical/jenkins caliper ci