CVE-2019-16572
First published: Tue Dec 17 2019(Updated: )
Jenkins Weibo Plugin 1.0.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.jenkins-ci.plugins:weibo | <=1.0.1 | |
| Jenkins | <=1.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-16572?
CVE-2019-16572 is rated as a medium severity vulnerability due to its potential exposure of sensitive credentials.
How do I fix CVE-2019-16572?
To fix CVE-2019-16572, upgrade the Weibo Plugin to version 1.0.2 or later which includes proper credential storage.
What does CVE-2019-16572 affect?
CVE-2019-16572 affects the Weibo Plugin for Jenkins versions 1.0.1 and earlier, specifically impacting credential storage.
Who can exploit CVE-2019-16572?
CVE-2019-16572 can be exploited by users with access to the Jenkins master file system, potentially allowing them to view unencrypted credentials.
Is CVE-2019-16572 related to any other vulnerabilities?
CVE-2019-16572 is related to general security concerns regarding sensitive data management within Jenkins, emphasizing secure storage practices.
- agent/type
- agent/description
- agent/first-publish-date
- agent/weakness
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-5c97-gxr3-r368
- alias/CVE-2019-16572
- agent/software-canonical-lookup
- agent/severity
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- agent/event
- agent/author
- collector/mitre-cve
- source/MITRE
- collector/github-advisory
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- collector/nvd-api
- package-manager/maven
- vendor/jenkins
- canonical/jenkins
- version/jenkins/1.0.1