CVE-2019-10426: Medium severity jenkins vulnerability
Published Sep 25, 2019
·Updated
Jenkins Gem Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Affected Software
1 affected component
Jenkins Gem Publisher Jenkins<=1.0
Event History
Sep 25, 2019
CVE Published
via MITRE·03:05 PM
Data Sourced
via MITRE·03:05 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-10426?
CVE-2019-10426 is classified as a medium severity vulnerability due to the exposure of unencrypted credentials.
2
How do I fix CVE-2019-10426?
To fix CVE-2019-10426, upgrade the Jenkins Gem Publisher Plugin to version 1.0 or later.
3
What versions of the Jenkins Gem Publisher Plugin are affected by CVE-2019-10426?
CVE-2019-10426 affects all versions of the Jenkins Gem Publisher Plugin prior to version 1.0.
4
What type of data is exposed in CVE-2019-10426?
CVE-2019-10426 exposes credentials stored unencrypted in the global configuration file.
5
Who is at risk due to CVE-2019-10426?
Users with access to the Jenkins master file system are at risk of viewing the exposed credentials due to CVE-2019-10426.