High severity · published Apr 30, 2019
CVE-2019-10318
Jenkins Azure AD Plugin 0.3.3 and earlier stored the client secret unencrypted in the global config.xml configuration file on the Jenkins master where it could be viewed by users…
8.8
CVSS
1.8%
EPSS
No
On KEV
Description
Jenkins Azure AD Plugin 0.3.3 and earlier stored the client secret unencrypted in the global config.xml configuration file on the Jenkins master where it could be viewed by users with access to the master file system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Azure AD · Jenkins
through 0.3.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-10318
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-10318
Mailing List
http://www.openwall.com/lists/oss-security/2019/04/30/5
Third Party Advisory
http://www.securityfocus.com/bid/108159
Vendor Advisory
https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1390
More from Azure AD
8.8
CVE-2023-24426
Jenkins Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the previous session on login
8.8
CVE-2021-21679
Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins
7.5
CVE-2023-41935
Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b_1154b_3fb_, uses a non-constant time comparison function when checking whether the provided and…
5.3
CVE-2020-2119
Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure
4.3
CVE-2026-42525
Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing…