CVE-2019-10378: Jenkins testlink Cleartext Storage of Credentials Information Disclosure Vulnerability
First published: Wed Aug 07 2019(Updated: )
Jenkins TestLink Plugin 3.16 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.jenkins-ci.plugins:testlink | <=3.16 | |
| Jenkins testlink | ||
| Jenkins Testlink | <=3.16 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://jenkins.io/security/advisory/2019-08-07/
- https://www.zerodayinitiative.com/advisories/ZDI-19-839/
- http://www.openwall.com/lists/oss-security/2019/08/07/1
- https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1428
- https://nvd.nist.gov/vuln/detail/CVE-2019-10378
- https://github.com/advisories/GHSA-qcfr-65hf-f98x (Advisory)
Frequently Asked Questions
What is the severity of CVE-2019-10378?
The severity of CVE-2019-10378 is medium with a CVSS score of 5.3.
How does the Jenkins testlink Cleartext Storage of Credentials Information Disclosure vulnerability impact affected installations?
The vulnerability allows local attackers to disclose sensitive information on affected Jenkins testlink installations.
Is authentication required to exploit CVE-2019-10378?
Yes, authentication is required to exploit this vulnerability.
What software is affected by CVE-2019-10378?
Jenkins testlink versions up to and including 3.16 are affected by this vulnerability.
How can I learn more about CVE-2019-10378?
You can find more information about this vulnerability in the references provided: [1], [2], [3].
- collector/github-advisory-latest
- alias/GHSA-qcfr-65hf-f98x
- alias/CVE-2019-10378
- collector/github-advisory
- agent/title
- agent/severity
- agent/references
- agent/type
- agent/weakness
- agent/author
- agent/description
- agent/event
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/zdi-advisory
- alias/ZDI-19-839
- alias/ZDI-CAN-8874
- agent/software-canonical-lookup-request
- collector/nvd-api
- collector/nvd-cve
- collector/nvd-index
- package-manager/maven
- vendor/jenkins
- canonical/jenkins testlink
- version/jenkins testlink/3.16