CVE-2019-10412
Jenkins Inedo ProGet Plugin Plugin has Cleartext Transmission of Sensitive Information
Jenkins Inedo ProGet Plugin 1.2 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Jenkins Inedo ProGet Plugin 1.2 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
- Record
CVE-2019-10412- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-319
- Updated
- 2026-11-02
CVE List No score
Jenkins Inedo ProGet Plugin 1.2 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
- Record
CVE-2019-10412- Updated
- 2026-11-02
EUVDEUVD-2022-3705 No score
Jenkins Inedo ProGet Plugin 1.2 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
- Record
EUVD-2022-3705- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f6g8-pxvp-9328
Jenkins Inedo ProGet Plugin Plugin has Cleartext Transmission of Sensitive Information
Inedo ProGet Plugin Plugin stores a service password in its global Jenkins configuration.
While the password is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations.
Inedo ProGet Plugin Plugin now encrypts the password transmitted to administrators viewing the global configuration form.
- Record
GHSA-f6g8-pxvp-9328- CVSS 3.0
- 3.1 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-319
- Updated
- 2026-11-02
OSVGHSA-f6g8-pxvp-9328
Jenkins Inedo ProGet Plugin Plugin has Cleartext Transmission of Sensitive Information
Inedo ProGet Plugin Plugin stores a service password in its global Jenkins configuration.
While the password is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations.
Inedo ProGet Plugin Plugin now encrypts the password transmitted to administrators viewing the global configuration form.
- Record
GHSA-f6g8-pxvp-9328- CVSS 3.0
- 3.1 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-319
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.inedo.proget:inedo-progetMaven |
before 1.3 | 1.3 |
com.inedo.proget:inedo-progetMaven |
before 1.3, plus listed versions 0.10.20.30.40.5 Show 6 moreShow less0.60.70.81.01.11.2 |
1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-10412 is a high vulnerability (CVSS 7.5) in Jenkins Inedo Proget, published September 25, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.89%, the 59th percentile. Fixed in com.inedo.proget:inedo-proget 1.3.