What is CVE-2019-10460?

CVE-2019-10460 is a high-severity vulnerability in Jenkins Bitbucket_oauth, classified under Insufficiently Protected Credentials. CVSS score: 7.8/10. Published 2019-10-23.

How severe is CVE-2019-10460?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in Jenkins Bitbucket_oauth

CVE-2019-10460

Jenkins Bitbucket OAuth Plugin 0.9 and earlier stored credentials unencrypted in the global config.xml configuration file on the Jenkins master where they could be viewed by users with access to the master file system.

EPSS: 0.003 (25.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Jenkins Bitbucket_oauth
Jenkins Project Bitbucket Oauth Plugin — versions 0.9 and earlier

Weakness classification (CWE)

CWE-522 — Insufficiently Protected Credentials

References

jenkinsci-cert@googlegroups.com (x_refsource_CONFIRM, Vendor Advisory)
jenkinsci-cert@googlegroups.com (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2019-10460?: CVE-2019-10460 is a high-severity vulnerability in Jenkins Bitbucket_oauth, classified under Insufficiently Protected Credentials. CVSS score: 7.8/10. Published 2019-10-23.
How severe is CVE-2019-10460?: High severity. CVSS v3 base score is 7.8 out of 10.