CVE-2019-10430

MEDIUM

Jenkins NeuVector Vulnerability Scanner < 1.5 - Cleartext Storage of Sensitive Information in Global Configuration

Title source: llm

Description

Jenkins NeuVector Vulnerability Scanner Plugin 1.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_confirm

https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1504

Mailing List mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2019/09/25/3

Scores

CVSS v3 5.5

EPSS 0.0001

EPSS Percentile 1.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-312

Status published

Products (2)

io.jenkins.plugins/neuvector-vulnerability-scanner 0 - 1.6Maven

jenkins/neuvector_vulnerability_scanner < 1.5

Published Sep 25, 2019

Tracked Since Feb 18, 2026