CVE-2019-10411: Jenkins Inedo BuildMaster Plugin Plain Text Password Exposure
Summary
CVE-2019-10411: Jenkins Inedo BuildMaster Plugin showed plain text password in configuration form. Affects com.inedo.proget:inedo-proget versions < 2.5.0. Fixed in 2.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Inedo BuildMaster Plugin is a plugin for the Jenkins automation server that integrates with Inedo BuildMaster, a release automation tool. It allows users to configure and manage BuildMaster deployments directly from Jenkins. The plugin is commonly used in software development and deployment workflows to streamline the release process.
Vulnerability Detail
The Jenkins Inedo BuildMaster Plugin stores a service password in its global Jenkins configuration. Although the password is encrypted on disk, it is transmitted in plain text as part of the configuration form. This exposes the password to potential risks such as browser extensions, cross-site scripting vulnerabilities, and similar situations. An attacker could intercept the plain text password and gain unauthorized access to the BuildMaster service. The vulnerability has a CVSS score of 3.1, indicating a low severity level.
How To Fix
Minimum fixed version
2.5.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Users are advised to update to the latest version of the plugin as soon as possible.
Conclusion
The Jenkins Inedo BuildMaster Plugin is vulnerable to a plain text password exposure issue, which could lead to unauthorized access to the BuildMaster service. Users should update to version 2.5.0 or later of the plugin to fix this vulnerability. It is also recommended to use Vulert Playground (https://vulert.com/scanner) to check for any other open-source vulnerabilities in your application. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for com.inedo.proget:inedo-proget →
FAQ
The vulnerability exposes the service password used by the Inedo BuildMaster Plugin in plain text, potentially allowing unauthorized access to the BuildMaster service.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file to the playground, and it will analyze and alert you in real-time for any open-source vulnerabilities, including this one.
Yes, the CVSS score for this vulnerability is 3.1, indicating a low severity level.
There are no known exploits for this vulnerability at the moment. However, it is still important to update to the latest version of the plugin to mitigate the risk.
No, the recommended solution is to update to the latest version of the Inedo BuildMaster Plugin, as it encrypts the password transmitted in the configuration form.
Related vulnerabilities
Recent vulnerabilities recorded for com.inedo.proget:inedo-proget.
