CVE-2019-10434: Jenkins LDAP Email Plugin shows plain text password in configuration form
Summary
CVE-2019-10434: Jenkins LDAP Email Plugin shows plain text password in configuration form. Affects com.mtvi.plateng.hudson:ldapemail versions < 0.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins LDAP Email Plugin is a Maven package (com.mtvi.plateng.hudson:ldapemail) that provides functionality for integrating LDAP authentication with email notifications in Jenkins. It allows users to configure LDAP credentials for email notifications in the global Jenkins configuration form.
Vulnerability Detail
The Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form. This can potentially result in the exposure of these credentials. The vulnerability has a low severity rating (CWE-256) and was published on May 24, 2022. It was reviewed by GitHub on January 28, 2023.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the Jenkins LDAP Email Plugin is vulnerable to a security issue where configured credentials are transmitted in plain text. It is important to update the plugin to a fixed version to ensure the protection of LDAP credentials. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for com.mtvi.plateng.hudson:ldapemail →
FAQ
This vulnerability can potentially expose LDAP credentials configured for email notifications in Jenkins.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file and the playground will alert you in real-time for any open-source vulnerabilities.
This vulnerability has a low severity rating.
Yes, it is recommended to update the Jenkins LDAP Email Plugin to a version that addresses the issue.
For more information, you can refer to the GitHub Advisory Database (https://github.com/github/advisory-database) and search for the advisory with the ID GHSA-53jw-4gwh-m8cm.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
