CVE-2019-10460
First published: Wed Oct 23 2019(Updated: )
Jenkins Bitbucket OAuth Plugin 0.9 and earlier stored credentials unencrypted in the global config.xml configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.jenkins-ci.plugins:bitbucket-oauth | <0.10 | 0.10 |
| Jenkins Bitbucket OAuth | <=0.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2019/10/23/2
- https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1546
- https://nvd.nist.gov/vuln/detail/CVE-2019-10460
- https://github.com/jenkinsci/bitbucket-oauth-plugin/commit/f55d222db910220ca8cd8631fb746c98b9e12870
- https://github.com/advisories/GHSA-84h6-jf8x-ff2j (Advisory)
Frequently Asked Questions
What is the severity of CVE-2019-10460?
CVE-2019-10460 is considered a high severity vulnerability due to unencrypted storage of credentials.
How do I fix CVE-2019-10460?
To fix CVE-2019-10460, upgrade the Jenkins Bitbucket OAuth Plugin to version 0.10 or later.
What are the risks associated with CVE-2019-10460?
The risks associated with CVE-2019-10460 include unauthorized access to sensitive credentials by users who can access the Jenkins master file system.
Which versions of Jenkins Bitbucket OAuth Plugin are affected by CVE-2019-10460?
All versions of Jenkins Bitbucket OAuth Plugin up to and including 0.9 are affected by CVE-2019-10460.
What type of vulnerability is CVE-2019-10460 classified as?
CVE-2019-10460 is classified as a credential management vulnerability due to the unencrypted storage of sensitive data.
- collector/github-advisory-latest
- alias/GHSA-84h6-jf8x-ff2j
- alias/CVE-2019-10460
- collector/github-advisory
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/references
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-index
- collector/nvd-cve
- package-manager/maven
- vendor/jenkins
- canonical/jenkins bitbucket oauth
- version/jenkins bitbucket oauth/0.9