CVE-2019-10461 Jenkins Dynatrace Plugin vulnerable to Insufficiently Protected Credentials

What is CVE-2019-10461?

CVE-2019-10461 is a high-severity vulnerability in Jenkins Dynatrace Application Monitoring Plugin, published on 23 Oct 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Jenkins Dynatrace Application Monitoring Plugin 2.1.3 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.

Weakness: CWE-522

Which versions are affected by CVE-2019-10461?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:dynatrace-dashboard. It affects 1 product.

Products include Jenkins Dynatrace Application Monitoring.

How do I fix CVE-2019-10461?

Upgrade org.jenkins-ci.plugins:dynatrace-dashboard to 2.1.4 or later.

Is CVE-2019-10461 being exploited?

There is no known exploitation of CVE-2019-10461 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Dynatrace Application Monitoring Plugin

• CVE-2019-10462 Jenkins Dynatrace Plugin vulnerable to Cross-Site Request Forgery High 8.1
• CVE-2019-10463 Jenkins Dynatrace Plugin contains Incorrect Default Permissions Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6xw9-qq9h-cr68.