CVE-2019-1003038

2019-03-0821:00:00

jenkins

www.cve.org

0.0004 Low

EPSS

Percentile

5.1%

JSON

An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jvnet/hudson/plugins/repositoryconnector/ArtifactDeployer.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/Repository.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/UserPwd.java that allows an attacker with local file system access or control of a Jenkins administrator’s web browser (e.g. malicious extension) to retrieve the password stored in the plugin configuration.

CNA Affected

[
  {
    "product": "Jenkins Repository Connector Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "status": "affected",
        "version": "1.2.4 and earlier"
      }
    ]
  }
]