Jenkins Azure PublisherSettings Credentials Plugin stored credentials in plain text

HIGH 8.8CVE-2019-10303 · GHSA-rfc8-wrrf-wp3w · Published 18/04/2019 · updated 17/06/2026

In short

CVE-2019-10303 is a HIGH (CVSS 8.8) vulnerability affecting org.jenkins-ci.plugins:azure-publishersettings-credentials, azure publishersettings credentials (jenkins).
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 71.8% of all vulnerabilities.
Fix: update to 1.5 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:azure-publishersettings-credentials Maven	`< 1.5`	`1.5`
azure publishersettings credentials jenkins	`≤ 1.2`	No fix yet

Description

Jenkins Azure PublisherSettings Credentials Plugin stored the service management certificate unencrypted in credentials.xml on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system.

Azure PublisherSettings Credentials Plugin has been deprecated. Azure PublisherSettings Credentials Plugin 1.5 no longer provides any user features and we recommend the plugin be uninstalled.

NVD description

Jenkins Azure PublisherSettings Credentials Plugin 1.2 and earlier stored credentials unencrypted in the credentials.xml file on the Jenkins master where they could be viewed by users with access to the master file system.

References

nvd.nist.gov/vuln/detail/CVE-2019-10303 · ADVISORY
jenkins.io/security/advisory/2019-04-17 · WEB
web.archive.org/web/20200227075952/http://www.securityfocus.com/bid/108045 · WEB
securityfocus.com/bid/108045 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:azure-publishersettings-credentials

Maven

< 1.5

1.5

azure publishersettings credentials

jenkins

≤ 1.2

No fix yet

Description

Azure PublisherSettings Credentials Plugin has been deprecated. Azure PublisherSettings Credentials Plugin 1.5 no longer provides any user features and we recommend the plugin be uninstalled.

NVD description