CVE-2019-10460 Jenkins Bitbucket OAuth Plugin contains Insufficiently Protected Credentials
Attackers with master file system access can read unencrypted credentials stored in the Jenkins Bitbucket OAuth Plugin configuration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10460?
CVE-2019-10460 is a high-severity vulnerability in Jenkins Bitbucket OAuth Plugin, published on 23 Oct 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Jenkins Bitbucket OAuth Plugin 0.9 and earlier stored credentials unencrypted in the global config.xml configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
Weakness: CWE-522
Which versions are affected by CVE-2019-10460?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:bitbucket-oauth. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:bitbucket-oauth Maven | All versions | 0.10 |
org.jenkins-ci.plugins:bitbucket-oauth Maven | All versions | 0.10 |
Products include Jenkins Bitbucket Oauth.
How do I fix CVE-2019-10460?
Upgrade org.jenkins-ci.plugins:bitbucket-oauth to 0.10 or later.
Is CVE-2019-10460 being exploited?
There is no known exploitation of CVE-2019-10460 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Bitbucket OAuth Plugin
Sources
Also known as GHSA-84h6-jf8x-ff2j.