CVE-2019-10461: Jenkins Dynatrace Plugin Insufficiently Protected Credentials
Summary
CVE-2019-10461: Jenkins Dynatrace Plugin vulnerable to Insufficiently Protected Credentials. Affects org.jenkins-ci.plugins:dynatrace-dashboard versions < 2.1.4. Fixed in 2.1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Dynatrace Plugin is an application monitoring plugin for Jenkins. It allows users to integrate Dynatrace Application Monitoring into their Jenkins pipelines. The plugin is used to monitor the performance and availability of applications during the build and deployment process. However, prior to version 2.1.4, the plugin stores credentials in an unencrypted format in its global configuration file on the Jenkins master. This means that users with access to the master file system can view these credentials.
Vulnerability Detail
The vulnerability (CVE-2019-10461) in the Jenkins Dynatrace Plugin arises from the insecure storage of credentials. The plugin does not encrypt the credentials stored in its global configuration file, making them easily accessible to users with access to the Jenkins master file system. This can lead to unauthorized access to sensitive information, such as API keys or passwords, which can be used to compromise the security of the Dynatrace Application Monitoring system. The vulnerability has a CVSS score of 7.8, indicating a high severity level.
How To Fix
Latest published version: 2.1.5 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed version of the plugin.
Conclusion
The Jenkins Dynatrace Plugin prior to version 2.1.4 is vulnerable to the storage of credentials in an unencrypted format. This can lead to unauthorized access to sensitive information and compromise the security of the Dynatrace Application Monitoring system. Users should upgrade to version 2.1.4 or later to fix the vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:dynatrace-dashboard →
FAQ
The vulnerability allows unauthorized users with access to the Jenkins master file system to view the unencrypted credentials stored by the plugin. This can lead to unauthorized access to sensitive information and potential compromise of the Dynatrace Application Monitoring system.
There is no known exploit available for this vulnerability at the moment. However, it is important to fix the vulnerability as soon as possible to prevent any potential unauthorized access.
No, only versions prior to 2.1.4 of the Jenkins Dynatrace Plugin are affected. Users should upgrade to version 2.1.4 or later to fix the vulnerability.
No, this vulnerability requires access to the Jenkins master file system to view the unencrypted credentials. It cannot be exploited remotely.
In addition to upgrading to the fixed version of the plugin, it is recommended to regularly monitor and review access to the Jenkins master file system to ensure that only authorized users have access.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:dynatrace-dashboard.
