CVE-2019-10385: Jenkins eggPlant Cleartext Storage of Credentials Information Disclosure Vulnerability
First published: Wed Aug 07 2019(Updated: )
Jenkins eggPlant Plugin 2.2 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins eggPlant | <=2.2 | |
| maven/org.jenkins-ci.plugins:eggplant-plugin | <=2.2 | |
| <=2.2 | ||
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://jenkins.io/security/advisory/2019-08-07/
- https://www.zerodayinitiative.com/advisories/ZDI-19-834/
- http://www.openwall.com/lists/oss-security/2019/08/07/1
- https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1430
- https://nvd.nist.gov/vuln/detail/CVE-2019-10385
- https://github.com/advisories/GHSA-xj63-95xc-jc4v (Advisory)
Frequently Asked Questions
What is CVE-2019-10385?
CVE-2019-10385 is a vulnerability that allows local attackers to disclose sensitive information on affected installations of Jenkins eggPlant.
How severe is CVE-2019-10385?
CVE-2019-10385 has a severity rating of 6.5 (medium).
What is the affected software?
The affected software is Jenkins eggPlant.
What is the specific flaw within the eggPlant plugin?
The specific flaw is the storage of credentials in plaintext.
Are authentication credentials required to exploit CVE-2019-10385?
Yes, authentication is required to exploit this vulnerability.
- collector/nvd-index
- collector/nvd-api
- agent/weakness
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-xj63-95xc-jc4v
- alias/CVE-2019-10385
- agent/software-canonical-lookup
- agent/references
- agent/severity
- agent/title
- agent/last-modified-date
- agent/description
- agent/author
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- source/NVD
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-19-834
- alias/ZDI-CAN-8876
- agent/event
- collector/github-advisory
- vendor/jenkins
- canonical/jenkins eggplant
- version/jenkins eggplant/2.2
- package-manager/maven