Jenkins LDAP Email Plugin shows plain text password in configuration form

ALTO 7.5CVE-2019-10434 · GHSA-53jw-4gwh-m8cm · Published 01/10/2019 · updated 17/06/2026

Em resumo

CVE-2019-10434 é uma vulnerabilidade ALTO (CVSS 7.5) que afeta com.mtvi.plateng.hudson:ldapemail, ldap email (jenkins).
Chance de exploração nos próximos 30 dias (EPSS): 0.89%, maior que 59.5% das vulnerabilidades.
Ainda não há versão corrigida: acompanhe o aviso do fornecedor em Referências.

Package	Affected versions	Patched versions
com.mtvi.plateng.hudson:ldapemail Maven	`≤ 0.8`	No fix yet
ldap email jenkins	`≤ 0.8`	No fix yet

Description

Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.

NVD description

Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.

References

nvd.nist.gov/vuln/detail/CVE-2019-10434 · ADVISORY
jenkinsci/ldapemail-plugin · PACKAGE
jenkins.io/security/advisory/2019-10-01 · WEB
openwall.com/lists/oss-security/2019/10/01/2 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free