Login Request a demo
Medium severity · published Sep 25, 2019
CVE-2019-10430
Jenkins NeuVector Vulnerability Scanner Plugin 1.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by…
5.5
CVSS
0.3%
EPSS
No
On KEV
Description
Jenkins NeuVector Vulnerability Scanner Plugin 1.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NV
Neuvector Vulnerability Scanner · Jenkins
through 1.5 · source: NVD
Affected product
NV
Neuvector Vulnerability Scanner
Jenkins
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-10430
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-10430
Mailing List
http://www.openwall.com/lists/oss-security/2019/09/25/3
Vendor Advisory
https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1504
More from Neuvector Vulnerability Scanner
8.8
CVE-2023-49673
A cross-site request forgery (CSRF) vulnerability in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers to connect to an attacker-specified hostname…
5.3
CVE-2023-30517
Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when connecting to a configured NeuVector…
5.3
CVE-2022-43434
Jenkins NeuVector Vulnerability Scanner Plugin 1.20 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived…
4.3
CVE-2023-49674
A missing permission check in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified…