CVE-2019-10283 Jenkins mabl Plugin stores credentials in plain text

What is CVE-2019-10283?

CVE-2019-10283 is a high-severity vulnerability in Jenkins mabl Plugin, published on 4 Apr 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Jenkins mabl Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Weakness: CWE-522

Which versions are affected by CVE-2019-10283?

2 open source packages ship an affected version, including com.mabl.integration.jenkins:mabl-integration. It affects 1 product.

Products include Jenkins Mabl.

How do I fix CVE-2019-10283?

Upgrade com.mabl.integration.jenkins:mabl-integration to 0.0.13 or later.

Is CVE-2019-10283 being exploited?

There is no known exploitation of CVE-2019-10283 in the wild and no public exploit code.

Other vulnerabilities in Jenkins mabl Plugin

• CVE-2023-37951 Jenkins mabl Plugin vulnerable to exposure of system-scooped credentials Medium 6.5
• CVE-2023-37952 Jenkins mabl Plugin vulnerable to cross-site request forgery Medium 6.5
• CVE-2023-37953 Jenkins mabl Plugin missing permission check Medium 6.5
• CVE-2023-37950 Jenkins mabl Plugin missing permission check Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hmf2-prm5-rvxm.