CVE-2019-10378
Jenkins testlink Cleartext Storage of Credentials Information Disclosure Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Jenkins TestLink Plugin 3.16 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
El Plugin TestLink de Jenkins versión 3.16 y anteriores, almacena las credenciales sin cifrar en su archivo de configuración global en el maestro de Jenkins, donde pueden ser visualizados por los usuarios con acceso al sistema de archivos maestro.
This vulnerability allows local attackers to disclose sensitive information on affected installations of Jenkins testlink. Authentication is required to exploit this vulnerability.
The specific flaw exists within the testlink plugin. The issue results from storing credentials in plaintext. An attacker can leverage this vulnerability to execute code in the context of the build process.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-03-29 CVE Reserved
- 2019-08-07 CVE Published
- 2024-08-04 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-522: Insufficiently Protected Credentials
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2019/08/07/1 | Mailing List |
|
| https://www.zerodayinitiative.com/advisories/ZDI-19-839 | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1428 | 2023-10-25 |