CVE-2019-1003038: jenkins project jenkins repository connector plugin Insufficiently Protected Credentials

Vulnerability summary

CVE-2019-1003038 is a high (CVSS 7.8) Insufficiently Protected Credentials vulnerability in jenkins project jenkins repository connector plugin. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 32.1% of scored vulnerabilities.

Timeline

1. 08-03-2019
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jvnet/hudson/plugins/repositoryconnector/ArtifactDeployer.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/Repository.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/UserPwd.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the password stored in the plugin configuration.

• CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.