CVE-2019-10415

MEDIUM

Jenkins Violation Comments TO Gitlab < 2.28 - Insufficiently Protected Credentials

Title source: rule

Description

Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_confirm

https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1577

Mailing List, Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2019/09/25/3

Scores

CVSS v3 6.5

EPSS 0.0005

EPSS Percentile 14.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-522

Status published

Products (2)

jenkins/violation_comments_to_gitlab < 2.28

org.jenkins-ci.plugins/violation-comments-to-gitlab 0 - 2.29Maven

Published Sep 25, 2019

Tracked Since Feb 18, 2026