CVE-2019-16556 Jenkins Rundeck Plugin stored credentials in plain text

What is CVE-2019-16556?

CVE-2019-16556 is a medium-severity vulnerability in Jenkins Rundeck Plugin, published on 17 Dec 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Jenkins Rundeck Plugin 3.6.5 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Weakness: CWE-522

Which versions are affected by CVE-2019-16556?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:rundeck. It affects 1 product.

Products include Jenkins Rundeck.

How do I fix CVE-2019-16556?

Upgrade org.jenkins-ci.plugins:rundeck to 3.6.6 or later.

Is CVE-2019-16556 being exploited?

There is no known exploitation of CVE-2019-16556 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Rundeck Plugin

• CVE-2022-41234 Missing webhook endpoint authorization in Jenkins Rundeck Plugin High 8.8
• CVE-2020-2144 XXE vulnerability in Rundeck Plugin High 7.1
• CVE-2022-30956 Cross-site Scripting in Jenkins Rundeck Plugin Medium 5.4
• CVE-2022-41233 Jenkins Rundeck Plugin Missing Authorization vulnerability Medium 4.3
• CVE-2019-10454 Jenkins Rundeck Plugin CSRF vulnerability Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qh3m-c6hw-5hmv.