CVE-2019-1003069 — Jenkins Aqua Security Scanner Plugin stores credentials in plain text

Description

Jenkins Aqua Security Scanner Plugin stores credentials unencrypted in its global configuration file `org.jenkinsci.plugins.aquadockerscannerbuildstep.AquaDockerScannerBuilder.xml` on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system.

How to fix CVE-2019-1003069

To remediate CVE-2019-1003069, upgrade the affected package to a fixed version below.

—upgrade to 3.0.16 or later

Is CVE-2019-1003069 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

from 0, < 3.0.16

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	LOW3.3	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References (4)

ADVISORYnvd.nist.gov/vuln/detail/CVE-2019-1003069
WEBjenkins.io/security/advisory/2019-04-03/#SECURITY-949
WEBplugins.jenkins.io/aqua-security-scanner
WEBwww.openwall.com/lists/oss-security/2019/04/12/2