Skip to content
Fencer Intel
medium 4.3

CVE-2019-10320 json

Insertion of Sensitive Information into Externally-Accessible File or Directory in Jenkins Credentials Plugin

published 7y ago modified 4mo ago also GHSA-xm94-9jw8-p6hw , EUVD-2022-5823

cvss
4.3
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 62%
public exploits
0
none known

Summary

Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.

Patch / fix

  • maven org.jenkins-ci.plugins:credentials 2.1.19
  • jenkins-2-plugins openshift 4.1 4.1.1561471763-1.el7
  • cri-o openshift 3.11 1.11.14-1.rhaos3.11.gitd56660e.el7
  • jenkins openshift 3.11 2.164.2.1555422716-1.el7
  • prometheus openshift 3.11 3.11.117-1.git.1.f52d417.el7
  • jenkins-2-plugins openshift 3.11 3.11.1559667994-1.el7
  • openshift-ansible openshift 3.11 3.11.123-1.git.0.db681ba.el7
  • openshift-ansible-test openshift 3.11 3.11.123-1.git.0.db681ba.el7
  • openshift-ansible-roles openshift 3.11 3.11.123-1.git.0.db681ba.el7

red hat advisories RHSA-2019:1636RHBA-2019:1605

Is CVE-2019-10320 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-10320 updated cvss 6.5

jenkins-credentials-plugin: Certificate file read vulnerability in Credentials Plugin (SECURITY-1322)

  • Red Hat OpenShift Container Platform 3.6 jenkins-plugin-credentials Red Hat OpenShift Container Platform 3.7 jenkins-plugin-credentials Red Hat OpenShift Container Platform 3.9 jenkins-plugin-credentials Red Hat OpenShift Container Platform 3.10 jenkins-plugin-credentials
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 3.11 jenkins 2.164.2.1555422716-1.el7, jenkins-2-plugins 3.11.1559667994-1.el7, prometheus 3.11.117-1.git.1.f52d417.el7, cri-o 1.11.14-1.rhaos3.11.gitd56660e.el7, openshift-ansible 3.11.123-1.git.0.db681ba.el7, openshift-ansible-test 3.11.123-1.git.0.db681ba.el7, +19 more
    fixed: vendor fix RHBA-2019:1605
  • Red Hat OpenShift Container Platform 4.1 jenkins-2-plugins 4.1.1561471763-1.el7
    fixed: vendor fix RHSA-2019:1636

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.97% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.0 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N
GitHub 3.0 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven org.jenkins-ci.plugins:credentials
<2.1.19
2.1.19

Affected products

  • Jenkins project Jenkins Credentials Plugin

Classification

Weakness
  • CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.