CVE-2019-10443: Jenkins iceScrum Cleartext Storage of Credentials Information Disclosure Vulnerability
Jenkins iceScrum Plugin 1.1.4 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.
Other sources
This vulnerability allows local attackers to disclose sensitive information on affected installations of Jenkins iceScrum. Authentication is required to exploit this vulnerability. The specific flaw exists within the iceScrum plugin. The issue results from storing credentials in plaintext. An attacker can leverage this vulnerability to execute code in the context of the build process.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10443?
CVE-2019-10443 is classified as a high severity vulnerability due to the exposure of unencrypted credentials.
How do I fix CVE-2019-10443?
To fix CVE-2019-10443, upgrade the iceScrum Plugin to version 1.1.5 or later, which addresses the vulnerability.
Who is affected by CVE-2019-10443?
CVE-2019-10443 affects users of the Jenkins iceScrum Plugin version 1.1.4 and earlier.
What impact does CVE-2019-10443 have on Jenkins users?
CVE-2019-10443 allows local attackers with Extended Read permission to view stored unencrypted credentials in job config files.
How can I prevent vulnerabilities like CVE-2019-10443 in the future?
To prevent similar vulnerabilities, always ensure that plugins are kept up to date and implement strict access controls.