8.8high
CVE-2019-10285
Jenkins Minio Storage Plugin stores credentials in plain text
Also known as GHSA-55f8-m8w5-fmq8
Published 7 y ago · modified 4 mo ago · JSON
CVSS
8.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
1.8%
percentile 78%
Public exploits
0
none known
Summary
Jenkins Minio Storage Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Exploit prediction (EPSS)
1.77% probability of exploitation in the next 30 days, higher than 78% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
| GitHub | 3.0 | 3.3 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:minio-storage | <=0.0.3 | no fix listed |
Affected products
- Jenkins project Jenkins Minio Storage Plugin
Classification
- Weakness
- CWE-522 Insufficiently Protected Credentials
References
- securityfocus.com /bid/107790 · vdb-entry, x_refsource_BID, x_transferred
- openwall.com /lists/oss-security/2019/04/12/2 · mailing-list, x_refsource_MLIST, x_transferred
- jenkins.io /security/advisory/2019-04-03/#SECURITY-955 · x_refsource_CONFIRM, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2019-10285 · advisory
Sources
- CVE List: CVE-2019-10285
- GitHub Advisory: GHSA-55f8-m8w5-fmq8
- NVD: CVE-2019-10285
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.