CVE-2019-16541: Jenkins JIRA Plugin allows users to select and use credentials with System scope
Summary
CVE-2019-16541: Jenkins JIRA Plugin allows users to select and use credentials with System scope. Affects org.jenkins-ci.plugins:jira versions < 3.0.11. Fixed in 3.0.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins JIRA Plugin is a plugin for the Jenkins automation server that allows users to integrate JIRA issue tracking system with Jenkins. It provides functionality to create, update, and manage JIRA issues directly from Jenkins. The plugin uses credentials to authenticate and authorize access to JIRA sites. The vulnerability in the plugin allows users to select and use credentials with System scope, even in per-folder JIRA site definitions. This means that users can potentially access and use credentials with higher privileges than intended, leading to unauthorized access and potential security breaches.
Vulnerability Detail
The vulnerability in the Jenkins JIRA Plugin (version 3.0.10 and earlier) lies in the incorrect declaration of the scope for per-folder JIRA site definitions. This allows users to select and use credentials with System scope, bypassing the intended folder scope. The impact of this vulnerability is that users can gain access to credentials with higher privileges than intended, potentially leading to unauthorized access and security breaches. The issue was addressed in version 3.0.11 of the plugin, which correctly defines the folder context for credential lookup. However, this fix may cause existing per-folder JIRA sites to lose access to already configured System-scoped credentials.
How To Fix
Latest published version: 3.22 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.11
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the fixed version of the Jenkins JIRA Plugin is the recommended solution.
Conclusion
The Jenkins JIRA Plugin vulnerability (CVE-2019-16541) allows users to select and use credentials with System scope, bypassing the intended folder scope. This can result in unauthorized access and potential security breaches. It is recommended to upgrade to version 3.0.11 or later of the plugin to fix the vulnerability. Review and reconfigure JIRA site definitions and credentials after the upgrade to ensure proper access control. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:jira →
FAQ
The vulnerability allows users to select and use credentials with System scope, potentially granting them higher privileges than intended. This can lead to unauthorized access and security breaches.
To fix this vulnerability, upgrade the Jenkins JIRA Plugin to version 3.0.11 or later. Review and reconfigure JIRA site definitions and credentials after the upgrade.
There are no known workarounds for this vulnerability. Upgrading to the fixed version of the Jenkins JIRA Plugin is the recommended solution.
Yes, the fix in version 3.0.11 may cause existing per-folder JIRA sites to lose access to already configured System-scoped credentials. It is important to review and reconfigure the credentials after the upgrade.
Yes, if you don't upgrade to the fixed version, users can continue to select and use credentials with System scope, potentially leading to unauthorized access and security breaches.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:jira.
