CVE-2019-1003038 - CVE House

Back to Database

Status published High CVE-2019-1003038

An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector...

7.8 CVSS

Vulnerability Description

An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jvnet/hudson/plugins/repositoryconnector/ArtifactDeployer.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/Repository.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/UserPwd.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the password stored in the plugin configuration.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-1003038

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Jenkins project

View All →

Jenkins Associated Files Plugin 0.2.1 and earlier does not escape...

Jenkins JAPEX Plugin 1.7 and earlier does not configure its...

A missing permission check in Jenkins Cluster Statistics Plugin 0.4.6...

A cross-site request forgery (CSRF) vulnerability in Jenkins Cluster Statistics...

Jenkins OSF Builder Suite : : XML Linter Plugin 1.0.2...

Affected Vendor

Jenkins project

View all reports →

Affected Software

Jenkins Repository Connector Plugin

Vulnerable Versions:

1.2.4 and earlier

Timeline

Official Publish: March 8th, 2019

Last Modified: August 5th, 2024

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.