4.3

CVSS Score

3.0

-

CVSS Score

Basic Information

CVE ID

CVE-2019-10414

GHSA ID

GHSA-h27g-72mh-9m33

EPSS Score

0.2067%

CWE

CWE-522

Published

5/24/2022

Updated

12/13/2023

KEV Status

Technology

Java

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2019-10414

CVE-2019-10414: Jenkins Git Changelog Plugin has Insufficiently Protected Credentials

Git Changelog Plugin stored MediaWiki and Jira passwords unencrypted in job config.xml files on the Jenkins controller. These passwords could be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

Git Changelog Plugin now stores these passwords encrypted. Existing jobs need to have their configuration saved for existing plain text passwords to be overwritten.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2019-10414

CVE-2019-10414:

4.3

CVSS Score

3.0

-

CVSS Score

Basic Information

CVE ID

CVE-2019-10414

GHSA ID

GHSA-h27g-72mh-9m33

EPSS Score

0.2067%

CWE

CWE-522

Published

5/24/2022

Updated

12/13/2023

KEV Status

Technology

Java

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Technical Details

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
de.wellnerbou.jenkins:git-changelog	maven	< 2.18	2.18

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stemmed from plaintext storage of credentials in config.xml files. The commit diff shows:

Removal of direct Jira username/password fields from GitChangelogConfig and form handling
Removal of all MediaWiki-related credential fields
Addition of transient modifiers to Jira credentials in config class
Replacement of raw credential fields with credential ID selectors in UI
The vulnerable functions were the setters that persisted credentials to disk unencrypted, and the descriptor method that processed user input into these fields.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

4.3

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2019-10414: Jenkins Git Changelog Plugin has Insufficiently Protected Credentials

CVE-2019-10414:

4.3

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

4.3

4.3

Basic Information

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

CVE-2019-10414: Jenkins Git Changelog Plugin has Insufficiently Protected Credentials

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI