What’s Vulnerable › Vulnerabilities

CVE-2019-1003038

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-03-08 · updated 2026-06-17
• Weakness: CWE-522

Description

An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jvnet/hudson/plugins/repositoryconnector/ArtifactDeployer.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/Repository.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/UserPwd.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the password stored in the plugin configuration.

Affected products

• Jenkins project Jenkins Repository Connector Plugin: through 1.2.4

References

• http://www.securityfocus.com/bid/107476
• https://jenkins.io/security/advisory/2019-03-06/#SECURITY-958
• http://www.securityfocus.com/bid/107476
• https://jenkins.io/security/advisory/2019-03-06/#SECURITY-958

Get alerted when CVE-2019-1003038 or the next vulnerability affects your stack