{"id":"CVE-2019-1003038","published":"2019-03-08T21:00:00Z","modified":"2024-08-05T03:07:16Z","title":"An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier…","vendor":"Jenkins","product":"Jenkins Repository Connector Plugin","tier":"tail","description":{"text":"An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jvnet/hudson/plugins/repositoryconnector/ArtifactDeployer.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/Repository.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/UserPwd.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the password stored in the plugin configuration.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00393,"percentile":0.33136,"provenance":"source"},"cwes":[],"references":[{"url":"https://jenkins.io/security/advisory/2019-03-06/#SECURITY-958","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/107476","tags":["vdb-entry","x_refsource_BID"]}],"priority":{"score":6.6,"factors":[{"name":"EPSS percentile","points":6.63}]},"vendorSlug":"jenkins","affectedVersions":[{"vendor":"Jenkins project","product":"Jenkins Repository Connector Plugin","versions":["1.2.4 and earlier"]}],"affected":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:repository-connector","vulnerableRanges":["<1.2.5"],"patched":["1.2.5"],"from":["GHSA-99jc-v8pq-6qm4"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-3339","exploited":false,"provenance":"source"}}