Miggo Logo
Miggo Vulnerability Database
→
CVE-2019-1003052

CVE-2019-1003052: Jenkins AWS Elastic Beanstalk Publisher Plugin stores credentials in plain text

3.3

CVSS Score
3.0

Basic Information

CVE ID
CVE-2019-1003052
GHSA ID
GHSA-vjr6-cq22-m4q5
EPSS Score
0.24824%
CWE
CWE-311
Published
5/13/2022
Updated
10/26/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jenkins-ci.plugins:aws-beanstalk-publisher-pluginmaven<= 1.7.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from unencrypted credential storage in AWSEBPublisher.xml. Jenkins plugins typically use Secret or Credentials API for sensitive data. The save() method would be responsible for serializing configuration data to disk, and setCredentials() would handle credential assignment. Both would need to lack encryption logic to cause plaintext storage. While exact implementation details aren't visible, these are core methods involved in credential persistence based on Jenkins plugin patterns and the described vulnerability mechanism.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

J*nkins *WS *l*sti* ***nst*lk Pu*lis**r Plu*in stor*s *r***nti*ls un*n*rypt** in its *lo**l *on*i*ur*tion *il* `or*.j*nkins*i.plu*ins.*ws***nst*lkpu*lis**r.*WS**Pu*lis**r.xml` on t** J*nkins *ontroll*r. T**s* *r***nti*ls **n ** vi*w** *y us*rs wit* *

Reasoning

T** vuln*r**ility st*ms *rom un*n*rypt** *r***nti*l stor*** in `*WS**Pu*lis**r.xml`. J*nkins plu*ins typi**lly us* S**r*t or *r***nti*ls *PI *or s*nsitiv* **t*. T** `s*v*()` m*t*o* woul* ** r*sponsi*l* *or s*ri*lizin* *on*i*ur*tion **t* to *isk, *n*