3.1

CVSS Score

3.0

-

CVSS Score

Basic Information

CVE ID

CVE-2019-10411

GHSA ID

GHSA-pxv2-mfq7-vhp6

EPSS Score

0.26082%

CWE

CWE-319

Published

5/24/2022

Updated

10/26/2023

KEV Status

Technology

Java

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2019-10411

CVE-2019-10411: Jenkins Inedo BuildMaster Plugin showed plain text password in configuration form

Jenkins Inedo BuildMaster Plugin Plugin stores a service password in its global Jenkins configuration.

While the password is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations.

Inedo BuildMaster Plugin Plugin now encrypts the password transmitted to administrators viewing the global configuration form.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2019-10411

CVE-2019-10411:

3.1

CVSS Score

3.0

-

CVSS Score

Basic Information

CVE ID

CVE-2019-10411

GHSA ID

GHSA-pxv2-mfq7-vhp6

EPSS Score

0.26082%

CWE

CWE-319

Published

5/24/2022

Updated

10/26/2023

KEV Status

Technology

Java

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Technical Details

CVSS Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.inedo.proget:inedo-proget	maven	< 2.5.0	2.5.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stemmed from handling credentials in plaintext during configuration form submissions. Key evidence from the commit shows:

setPassword() originally took a String parameter (plaintext) and converted it to Secret, meaning plaintext was present in memory during form processing
getPassword() returned Secret.toString() which decrypts the secret, exposing it in configuration form responses
doTestConnection's @QueryParameter for password was changed from String to Secret type, indicating it previously received plaintext credentials These functions collectively enabled the plaintext transmission flow described in CVE-2019-10411 by failing to properly handle credential encryption during form submission and rendering.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

3.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2019-10411: Jenkins Inedo BuildMaster Plugin showed plain text password in configuration form

CVE-2019-10411:

3.1

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

3.1

3.1

Technical Details

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

CVE-2019-10411: Jenkins Inedo BuildMaster Plugin showed plain text password in configuration form

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI