VulnerabilityModified

CVE-2019-10430

Jenkins NeuVector Vulnerability Scanner Plugin 1.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.

MEDIUM 5.5EPSS 0.25%

Does this matter?

Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 3.1: 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.25% probability · 17th percentile
CISA KEV: Not listed
Weakness: CWE-312
Affected: jenkins/neuvector vulnerability scanner
Source: jenkinsci-cert@googlegroups.com

References

http://www.openwall.com/lists/oss-security/2019/09/25/3Mailing List
https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1504Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/09/25/3Mailing List
https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1504Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.