CVE-2019-10425
Global infos:
Jenkins Google Calendar Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVE Status: Modified
References:
Metrics:
| Attribute | Value |
|---|---|
| Attack Complexity | LOW |
| Attack Vector | NETWORK |
| Availability Impact | NONE |
| Base Score | 6.5 |
| Base Severity | MEDIUM |
| Confidentiality Impact | HIGH |
| Integrity Impact | NONE |
| Privileges Required | LOW |
| Scope | UNCHANGED |
| User Interaction | NONE |
| Vector String | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| Exploitability Score | 2.8 |
| Impact Score | 3.6 |
| Source | [email protected] |
| Type | Primary |