Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2019-10347

Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users with access to the master file system.

VectorNETWORK

PublishedJul 11, 2019, 14:15

Published Byjenkinsci-cert@googlegroups.com

Base Score

Score8.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

javagh.jenkins:mashup-portlets-plugin(Maven)01.1.0N/A

References

http://www.openwall.com/lists/oss-security/2019/07/11/4
http://www.securityfocus.com/bid/109156
https://jenkins.io/security/advisory/2019-07-11/#SECURITY-775

Weakness Type

CWE-522

CVSS Metrics

Base Score

8.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK