Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Jenkins AppDynamics Plugin Exposes Job Credentials

CVE-2019-1003039 · published 7 years ago
Summary

The Jenkins AppDynamics Plugin, used for monitoring and tracking application performance, stores sensitive job passwords in an insecure way. This means that anyone with access to the plugin can obtain these passwords, potentially allowing them to access and control the monitored applications. Update to the latest version of the plugin to ensure your credentials are properly protected.

What to do
  • Update jenkins-ci org.jenkins-ci.plugins:appdynamics-dashboard to version 1.0.15.
Affected software
Ecosystem VendorProductAffected versions
maven jenkins-ci org.jenkins-ci.plugins:appdynamics-dashboard <= 1.0.14
Fix: upgrade to 1.0.15
– jenkins appdynamics <= 1.0.14
cpe:2.3:a:jenkins:appdynamics:*:*:*:*:*:jenkins:*:*
Original advisory text
An insufficiently protected credentials vulnerability exists in JenkinsAppDynamics Dashboard Plugin 1.0.14 and earlier in src/main/java/nl/codecentric/jenkins/appd/AppDynamicsResultsPublisher.java ...
An insufficiently protected credentials vulnerability exists in JenkinsAppDynamics Dashboard Plugin 1.0.14 and earlier in src/main/java/nl/codecentric/jenkins/appd/AppDynamicsResultsPublisher.java that allows attackers without permission to obtain passwords configured in jobs to obtain them.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
8.8 High
Exploitation
1% chance of attack within 30 days
Type
CWE-522Insufficiently Protected Credentials
Timeline
Published8 Mar 2019
Updated2 Nov 2026
First seen6 Mar 2026
Sources
GHSA-mmqx-g78c-hvfj · GHSA
CVE-2019-1003039 · NVD
Track software like this
Free during beta