CVE-2019-1003064

EPSS 0.08%
Published 04.04.2019 16:29:00
Last modified 21.11.2024 04:17:50
Source jenkinsci-cert@googlegroups.co
Teams watchlist Login
Open Login

Jenkins aws-device-farm Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Affected products Warnungen 0 Metrics 3 CWE 1 References 6

Data is provided by the National Vulnerability Database (NVD)

Jenkins ≫ Aws-device-farm SwPlatformjenkins

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.08%	0.246

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	4	8	2.9	AV:N/AC:L/Au:S/C:P/I:N/A:N

CWE-311 Missing Encryption of Sensitive Data

The product does not encrypt sensitive or critical information before storage or transmission.

http://www.openwall.com/lists/oss-security/2019/04/12/2

Third Party Advisory

Mailing List

http://www.securityfocus.com/bid/107790

Third Party Advisory

VDB Entry

https://jenkins.io/security/advisory/2019-04-03/#SECURITY-835

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-1003064

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-1003064

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-1003064

EUVD