Jenkins Aqua Security Scanner Plugin showed plain text password in configuration form

高危 7.5CVE-2019-10428 · GHSA-xp44-8vwr-xwmv · Published 25/09/2019 · updated 17/06/2026

要点

CVE-2019-10428 是影响 org.jenkins-ci.plugins:aqua-security-scanner, aqua security scanner (jenkins) 的高危 (CVSS 7.5)漏洞。
未来 30 天内被利用的概率（EPSS）：0.89%，高于 59.4% 的漏洞。
修复：升级到 3.0.18 或更高版本。

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:aqua-security-scanner Maven	`< 3.0.18`	`3.0.18`
aqua security scanner jenkins	`≤ 3.0.17`	No fix yet

Description

Jenkins Aqua Security Scanner Plugin 3.0.17 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.

NVD description

Jenkins Aqua Security Scanner Plugin 3.0.17 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.

References

nvd.nist.gov/vuln/detail/CVE-2019-10428 · ADVISORY
jenkins.io/security/advisory/2019-09-25 · WEB
openwall.com/lists/oss-security/2019/09/25/3 · WEB

org.jenkins-ci.plugins:aqua-security-scanner 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:aqua-security-scanner

Maven

< 3.0.18

3.0.18

aqua security scanner

jenkins

≤ 3.0.17

No fix yet

Description

Jenkins Aqua Security Scanner Plugin 3.0.17 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.

NVD description

Jenkins Aqua Security Scanner Plugin 3.0.17 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.

org.jenkins-ci.plugins:aqua-security-scanner 的其他漏洞

查看全部 →