Miggo Logo
Miggo Vulnerability Database
→
CVE-2019-10283

CVE-2019-10283: Jenkins mabl Plugin stores credentials in plain text

4.3

CVSS Score
3.0

Basic Information

CVE ID
CVE-2019-10283
GHSA ID
GHSA-hmf2-prm5-rvxm
EPSS Score
0.24491%
CWE
CWE-522
Published
5/13/2022
Updated
10/26/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
com.mabl.integration.jenkins:mabl-integrationmaven<= 0.0.120.0.13

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability centers on plaintext credential storage in job config.xml files. In Jenkins plugin architecture:

  1. Builders/Publishers serialize their configuration via XStream
  2. Getter methods directly influence XML output
  3. The advisory specifically mentions job config.xml exposure

While the exact patch isn't visible, the pattern matches Jenkins credential handling vulnerabilities:

  • Plaintext fields in Describable classes
  • Missing @DataBoundConstructor validation
  • Absence of Secret class wrapping

Top candidates are the configuration object's getters/setters that handle API keys. The execution class might also expose credentials during runtime operations.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

J*nkins m**l Plu*in stor*s *r***nti*ls un*n*rypt** in jo* `*on*i*.xml` *il*s on t** J*nkins *ontroll*r. T**s* *r***nti*ls **n ** vi*w** *y us*rs wit* *xt*n*** R*** p*rmission, or ****ss to t** J*nkins *ontroll*r *il* syst*m.

Reasoning

T** vuln*r**ility **nt*rs on pl*int*xt *r***nti*l stor*** in jo* *on*i*.xml *il*s. In J*nkins plu*in *r**it**tur*: *. *uil**rs/Pu*lis**rs s*ri*liz* t**ir *on*i*ur*tion vi* XStr**m *. **tt*r m*t*o*s *ir**tly in*lu*n** XML output *. T** **visory sp**i*