CVE-2019-10450

LOW

3.3

Description

Jenkins ElasticBox CI Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

CVE Details

CVSS v3.1 Score3.3

SeverityLOW

CVSS VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack VectorLOCAL

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published10/16/2019

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

jenkins:elasticbox_ci

Weaknesses (CWE)

CWE-312

References

https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1434(jenkinsci-cert@googlegroups.com)

https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1434(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.