Jenkins SOASTA CloudTest Plugin stores API token in plain text

MEDIUM 4.3CVE-2019-10451 · GHSA-7hp3-5w4x-8f7c · Published 16/10/2019 · updated 17/06/2026

In short

CVE-2019-10451 is a MEDIUM (CVSS 4.3) vulnerability affecting com.soasta.jenkins:cloudtest, soasta cloudtest (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.47%, higher than 40.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
com.soasta.jenkins:cloudtest Maven	`≤ 2.25`	No fix yet
soasta cloudtest jenkins	`≤ 2.25`	No fix yet

Description

Jenkins SOASTA CloudTest Plugin stores credentials unencrypted in its global configuration file com.soasta.jenkins.CloudTestServer.xml on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system.

As of publication of this advisory there is no fix.

NVD description

Jenkins SOASTA CloudTest Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

References

nvd.nist.gov/vuln/detail/CVE-2019-10451 · ADVISORY
jenkins.io/security/advisory/2019-10-16 · WEB

More vulnerabilities in com.soasta.jenkins:cloudtest

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

com.soasta.jenkins:cloudtest

Maven

≤ 2.25

No fix yet

soasta cloudtest

jenkins

≤ 2.25

No fix yet

Description

As of publication of this advisory there is no fix.

NVD description

Jenkins SOASTA CloudTest Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

More vulnerabilities in com.soasta.jenkins:cloudtest

See all →