Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2019-10361

Jenkins Maven Release Plugin 0.14.0 and earlier stored credentials unencrypted on the Jenkins master where they could be viewed by users with access to the master file system.

VectorLOCAL

PublishedJul 31, 2019, 13:15

Published Byjenkinsci-cert@googlegroups.com

Base Score

Score5.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.jenkins-ci.plugins.m2release:m2release(Maven)00.15.0N/A

References

http://www.openwall.com/lists/oss-security/2019/07/31/1
https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1435
https://www.zerodayinitiative.com/advisories/ZDI-19-835/

Weakness Type

CWE-522

CVSS Metrics

Base Score

5.5

Vector String

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

LOCAL