CVE-2019-10411
Jenkins Inedo BuildMaster Plugin showed plain text password in configuration form
Jenkins Inedo BuildMaster Plugin 2.4.0 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Jenkins Inedo BuildMaster Plugin 2.4.0 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
- Record
CVE-2019-10411- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-319
- Updated
- 2026-11-02
CVE List No score
Jenkins Inedo BuildMaster Plugin 2.4.0 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
- Record
CVE-2019-10411- Updated
- 2026-11-02
EUVDEUVD-2022-4855 No score
Jenkins Inedo BuildMaster Plugin 2.4.0 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
- Record
EUVD-2022-4855- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pxv2-mfq7-vhp6
Jenkins Inedo BuildMaster Plugin showed plain text password in configuration form
Jenkins Inedo BuildMaster Plugin Plugin stores a service password in its global Jenkins configuration.
While the password is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations.
Inedo BuildMaster Plugin Plugin now encrypts the password transmitted to administrators viewing the global configuration form.
- Record
GHSA-pxv2-mfq7-vhp6- CVSS 3.0
- 3.1 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-319
- Updated
- 2026-11-02
OSV
Jenkins Inedo BuildMaster Plugin 2.4.0 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
- Record
CVE-2019-10411- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-pxv2-mfq7-vhp6
Jenkins Inedo BuildMaster Plugin showed plain text password in configuration form
Jenkins Inedo BuildMaster Plugin Plugin stores a service password in its global Jenkins configuration.
While the password is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations.
Inedo BuildMaster Plugin Plugin now encrypts the password transmitted to administrators viewing the global configuration form.
- Record
GHSA-pxv2-mfq7-vhp6- CVSS 3.0
- 3.1 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-319
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.inedo.proget:inedo-progetMaven |
before 2.5.0 | 2.5.0 |
com.inedo.proget:inedo-progetMaven |
before 2.5.0, plus listed versions 0.10.20.30.40.5 Show 8 moreShow less0.60.70.81.01.11.21.31.4 |
2.5.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-10411 is a high vulnerability (CVSS 7.5) in Jenkins Inedo Buildmaster, published September 25, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.95%, the 61st percentile. Fixed in com.inedo.proget:inedo-proget 2.5.0.
References
jenkins.io/security/advisory/2019-09-25
openwall.com/lists/oss-security/2019/09/25/3
nvd.nist.gov/vuln/detail/CVE-2019-10411
github.com/jenkinsci/inedo-buildmaster-plugin/commit/cef77a827e92718fc89728397e428872fd2518b1