Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Jenkins Aqua Security Scanner Plugin stores credentials insecurely

CVE-2019-1003069 · published 7 years ago
Summary

The Jenkins Aqua Security Scanner Plugin stores sensitive credentials in a file that can be accessed by anyone with permission to the master file system. This means that if an unauthorized user gains access to the master file system, they can see and potentially use the stored credentials. To protect against this, consider encrypting or restricting access to the global configuration file.

What to do
  • Update jenkins-ci org.jenkins-ci.plugins:aqua-security-scanner to version 3.0.16.
Affected software
Ecosystem VendorProductAffected versions
maven jenkins-ci org.jenkins-ci.plugins:aqua-security-scanner <= 3.0.15
Fix: upgrade to 3.0.16
– jenkins aqua_security_scanner All versions
cpe:2.3:a:jenkins:aqua_security_scanner:*:*:*:*:*:jenkins:*:*
Original advisory text
Jenkins Aqua Security Scanner Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Jenkins Aqua Security Scanner Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
8.8 High
Exploitation
1% chance of attack within 30 days
Type
CWE-311Missing Encryption of Sensitive Data
Timeline
Published4 Apr 2019
Updated2 Nov 2026
First seen6 Mar 2026
Sources
GHSA-3j3v-7f8f-v2xp · GHSA
CVE-2019-1003069 · NVD
Track software like this
Free during beta