Miggo Logo
Miggo Vulnerability Database
→
CVE-2019-10430

CVE-2019-10430: Jenkins NeuVector Vulnerability Scanner Plugin stored credentials in plain text

5.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2019-10430
GHSA ID
GHSA-3fpx-g9h3-hh8x
EPSS Score
0.07529%
CWE
CWE-312
Published
5/24/2022
Updated
1/30/2024
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
io.jenkins.plugins:neuvector-vulnerability-scannermaven<= 1.51.6

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from unencrypted credential storage in the plugin's global configuration. Analysis focuses on configuration handling mechanisms:

  1. The DescriptorImpl.configure method is the standard Jenkins extension point for persisting global configuration, making it the logical location for plaintext storage
  2. The getCredentials method would be called during XML serialization to provide credential values for storage
  3. Advisory explicitly mentions the NeuVectorBuilder.xml file format changed from plaintext to encrypted credentials
  4. Typical Jenkins credential handling patterns require explicit encryption via Credentials API, which was missing here Confidence is medium due to inferred implementation patterns without seeing actual patch code, but grounded in Jenkins plugin architecture specifics and advisory details

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

J*nkins N*uV**tor Vuln*r**ility S**nn*r Plu*in *.* *n* **rli*r stor** *r***nti*ls un*n*rypt** in its *lo**l *on*i*ur*tion *il* on t** J*nkins m*st*r w**r* t**y *oul* ** vi*w** *y us*rs wit* ****ss to t** m*st*r *il* syst*m.

Reasoning

T** vuln*r**ility st*ms *rom un*n*rypt** *r***nti*l stor*** in t** plu*in's *lo**l *on*i*ur*tion. *n*lysis *o*us*s on *on*i*ur*tion **n*lin* m****nisms: *. T** **s*riptorImpl.*on*i*ur* m*t*o* is t** st*n**r* J*nkins *xt*nsion point *or p*rsistin* *lo