Miggo Logo
Miggo Vulnerability Database
→
CVE-2019-16572

CVE-2019-16572: Jenkins Weibo Plugin stores credentials unencrypted in its global configuration file

3.3

CVSS Score
3.0

Basic Information

CVE ID
CVE-2019-16572
GHSA ID
GHSA-5c97-gxr3-r368
EPSS Score
0.09244%
CWE
CWE-256
Published
5/24/2022
Updated
8/9/2024
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jenkins-ci.plugins:weibomaven<= 1.0.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from unencrypted credential storage in WeiboNotifier.xml. Jenkins plugins typically handle configuration through DescriptorImpl.configure for global settings and store sensitive data using Secret objects. The presence of plaintext credentials in the XML file implies:

  1. The configure method fails to use Jenkins' Secret API during configuration persistence
  2. The credential field in WeiboNotifier is stored as a plain String rather than a Secret
  3. The XStream serialization (used by Jenkins for config files) isn't leveraging credential protection mechanisms While exact code isn't available, Jenkins plugin architecture patterns and the specific file path mentioned in advisories strongly indicate these entry points.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

J*nkins W*i*o Plu*in *.*.* *n* **rli*r stor*s *r***nti*ls un*n*rypt** in its *lo**l *on*i*ur*tion *il* on t** J*nkins m*st*r w**r* t**y **n ** vi*w** *y us*rs wit* ****ss to t** m*st*r *il* syst*m.

Reasoning

T** vuln*r**ility st*ms *rom un*n*rypt** *r***nti*l stor*** in W*i*oNoti*i*r.xml. J*nkins plu*ins typi**lly **n*l* *on*i*ur*tion t*rou** **s*riptorImpl.*on*i*ur* *or *lo**l s*ttin*s *n* stor* s*nsitiv* **t* usin* S**r*t o*j**ts. T** pr*s*n** o* pl*in