What is CVE-2019-10318?

CVE-2019-10318 is a high-severity vulnerability in Jenkins Azure_ad, classified under Insufficiently Protected Credentials. CVSS score: 8.8/10. Published 2019-04-30.

How severe is CVE-2019-10318?

High severity. CVSS v3 base score is 8.8 out of 10.

Vulnerability in Jenkins Azure_ad

CVE-2019-10318

Jenkins Azure AD Plugin 0.3.3 and earlier stored the client secret unencrypted in the global config.xml configuration file on the Jenkins master where it could be viewed by users with access to the master file system.

EPSS: 0.018 (76.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Jenkins Azure_ad
Jenkins Project Azure Ad Plugin — versions 0.3.3 and earlier

Weakness classification (CWE)

CWE-522 — Insufficiently Protected Credentials

References

jenkinsci-cert@googlegroups.com (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
jenkinsci-cert@googlegroups.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
jenkinsci-cert@googlegroups.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2019-10318?: CVE-2019-10318 is a high-severity vulnerability in Jenkins Azure_ad, classified under Insufficiently Protected Credentials. CVSS score: 8.8/10. Published 2019-04-30.
How severe is CVE-2019-10318?: High severity. CVSS v3 base score is 8.8 out of 10.