CVE-2019-10424: Medium severity jenkins vulnerability
Published Sep 25, 2019
·Updated
Jenkins elOyente Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected Software
1 affected component
Jenkins Eloyente Jenkins<=1.3
Event History
Sep 25, 2019
CVE Published
via MITRE·03:05 PM
Data Sourced
via MITRE·03:05 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-10424?
CVE-2019-10424 is considered a high severity vulnerability because it exposes sensitive credentials unencrypted.
2
How do I fix CVE-2019-10424?
To fix CVE-2019-10424, upgrade the Jenkins elOyente Plugin to version 1.4 or higher.
3
What are the implications of CVE-2019-10424?
CVE-2019-10424 allows unauthorized users to access unencrypted credentials stored in the Jenkins master configuration file.
4
Which versions of the elOyente Plugin are affected by CVE-2019-10424?
CVE-2019-10424 affects versions up to and including 1.3 of the Jenkins elOyente Plugin.
5
Who is at risk from CVE-2019-10424?
Users with file system access to the Jenkins master are at risk from CVE-2019-10424 due to the exposure of sensitive credentials.