6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2019-10467

CVE-2019-10467: Jenkins Sonar Gerrit Plugin stores credentials unencrypted

Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2019-10467

CVE-2019-10467:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.jenkins-ci.plugins:sonar-gerrit	maven	< 2.4.5	2.4.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stemmed from handling passwords as plain text strings rather than encrypted Secrets. Key indicators:

The password field was stored as String type instead of hudson.util.Secret
Direct getter/setter methods (getPassword/setPassword) manipulated plain text values
The Jelly UI configuration bound to 'password' field instead of encrypted 'secretPassword'
Commit d86de84 explicitly replaced String password with Secret password and deprecated the vulnerable methods
Test cases were removed/modified to reflect the insecure nature of password handling in older versions

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

6.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2019-10467: Jenkins Sonar Gerrit Plugin stores credentials unencrypted

CVE-2019-10467:

6.5

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Vulnerability Intelligence
Miggo AI

Detect and Respond To Threats Faster.

CVE-2019-10467: Jenkins Sonar Gerrit Plugin stores credentials unencrypted

6.5

6.5

Basic Information

Basic Information

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

6.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2019-10467: Jenkins Sonar Gerrit Plugin stores credentials unencrypted

CVE-2019-10467:

6.5

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Vulnerability IntelligenceMiggo AI

CVE-2019-10467: Jenkins Sonar Gerrit Plugin stores credentials unencrypted

6.5

6.5

Basic Information

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI