Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2019-1003064

Jenkins aws-device-farm Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

VectorNETWORK

PublishedApr 04, 2019, 16:29

Published Byjenkinsci-cert@googlegroups.com

Base Score

Score8.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.jenkins-ci.plugins:aws-device-farm(Maven)01.26N/A

References

http://www.openwall.com/lists/oss-security/2019/04/12/2
http://www.securityfocus.com/bid/107790
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-835

Weakness Type

CWE-311

CVSS Metrics

Base Score

8.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK