CVE-2019-10320
Insertion of Sensitive Information into Externally-Accessible File or Directory in Jenkins Credentials Plugin
Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.
- Record
CVE-2019-10320- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-538
- Updated
- 2026-11-02
CVE List No score
Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.
- Record
CVE-2019-10320- Updated
- 2026-11-02
EUVDEUVD-2022-5823 No score
Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.
- Record
EUVD-2022-5823- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xm94-9jw8-p6hw
Insertion of Sensitive Information into Externally-Accessible File or Directory in Jenkins Credentials Plugin
Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.
- Record
GHSA-xm94-9jw8-p6hw- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-538
- Updated
- 2026-11-02
OSV
Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.
- Record
CVE-2019-10320- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-xm94-9jw8-p6hw
Insertion of Sensitive Information into Externally-Accessible File or Directory in Jenkins Credentials Plugin
Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.
- Record
GHSA-xm94-9jw8-p6hw- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-538
- Updated
- 2026-11-02
OSVRHBA-2019:1605
Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix and enhancement update
- Record
RHBA-2019:1605- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2019:1636
Red Hat Security Advisory: OpenShift Container Platform 4.1 jenkins-2-plugins security update
- Record
RHSA-2019:1636- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:credentialsMaven |
through 2.1.18 | 2.1.19 |
org.jenkins-ci.plugins:credentialsMaven |
before 2.1.19, plus listed versions 1.01.11.101.111.12 Show 45 moreShow less1.131.141.151.161.16.11.171.181.191.21.201.211.221.231.241.251.261.271.281.31.3.11.41.51.61.71.7.11.7.21.7.31.7.41.7.51.7.61.81.8.11.8.21.8.31.8.41.91.9.11.9.21.9.31.9.42.02.0.12.0.22.0.32.0.4 |
2.1.19 |
atomic-enterprise-service-catalogRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 1:3.11.117-1.git.1.376e432.el7 | 1:3.11.117-1.git.1.376e432.el7 |
atomic-enterprise-service-catalog-svcatRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 1:3.11.117-1.git.1.376e432.el7 | 1:3.11.117-1.git.1.376e432.el7 |
atomic-openshift-cluster-autoscalerRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:3.11.117-1.git.1.caa79fa.el7 | 0:3.11.117-1.git.1.caa79fa.el7 |
atomic-openshift-deschedulerRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:3.11.117-1.git.1.1635b0a.el7 | 0:3.11.117-1.git.1.1635b0a.el7 |
atomic-openshift-dockerregistryRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:3.11.117-1.git.1.6a42b08.el7 | 0:3.11.117-1.git.1.6a42b08.el7 |
atomic-openshift-metrics-serverRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:3.11.117-1.git.1.319d58e.el7 | 0:3.11.117-1.git.1.319d58e.el7 |
atomic-openshift-node-problem-detectorRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:3.11.117-1.git.1.0345fe3.el7 | 0:3.11.117-1.git.1.0345fe3.el7 |
atomic-openshift-service-idlerRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:3.11.117-1.git.1.887bb82.el7 | 0:3.11.117-1.git.1.887bb82.el7 |
Show 20 moreShow less
| Package | Affected | Fixed |
|---|---|---|
atomic-openshift-web-consoleRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:3.11.117-1.git.1.be7a05c.el7 | 0:3.11.117-1.git.1.be7a05c.el7 |
cri-oRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:1.11.14-1.rhaos3.11.gitd56660e.el7 | 0:1.11.14-1.rhaos3.11.gitd56660e.el7 |
cri-o-debuginfoRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:1.11.14-1.rhaos3.11.gitd56660e.el7 | 0:1.11.14-1.rhaos3.11.gitd56660e.el7 |
golang-github-openshift-oauth-proxyRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:3.11.117-1.git.1.2b006d2.el7 | 0:3.11.117-1.git.1.2b006d2.el7 |
golang-github-prometheus-alertmanagerRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:3.11.117-1.git.1.207ef35.el7 | 0:3.11.117-1.git.1.207ef35.el7 |
golang-github-prometheus-node_exporterRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:3.11.117-1.git.1.dcee33f.el7 | 0:3.11.117-1.git.1.dcee33f.el7 |
golang-github-prometheus-prometheusRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:3.11.117-1.git.1.f52d417.el7 | 0:3.11.117-1.git.1.f52d417.el7 |
jenkinsRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:2.164.2.1555422716-1.el7 | 0:2.164.2.1555422716-1.el7 |
jenkins-2-pluginsRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:3.11.1559667994-1.el7 | 0:3.11.1559667994-1.el7 |
openshift-ansibleRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:3.11.123-1.git.0.db681ba.el7 | 0:3.11.123-1.git.0.db681ba.el7 |
openshift-ansible-docsRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:3.11.123-1.git.0.db681ba.el7 | 0:3.11.123-1.git.0.db681ba.el7 |
openshift-ansible-playbooksRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:3.11.123-1.git.0.db681ba.el7 | 0:3.11.123-1.git.0.db681ba.el7 |
openshift-ansible-rolesRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:3.11.123-1.git.0.db681ba.el7 | 0:3.11.123-1.git.0.db681ba.el7 |
openshift-ansible-testRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:3.11.123-1.git.0.db681ba.el7 | 0:3.11.123-1.git.0.db681ba.el7 |
openshift-enterprise-autohealRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:3.11.117-1.git.1.ef32a58.el7 | 0:3.11.117-1.git.1.ef32a58.el7 |
openshift-enterprise-cluster-capacityRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:3.11.117-1.git.1.6593fce.el7 | 0:3.11.117-1.git.1.6593fce.el7 |
prometheusRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:3.11.117-1.git.1.f52d417.el7 | 0:3.11.117-1.git.1.f52d417.el7 |
prometheus-alertmanagerRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:3.11.117-1.git.1.207ef35.el7 | 0:3.11.117-1.git.1.207ef35.el7 |
prometheus-node-exporterRed Hat:openshift:3.11::el7 From an advisory covering 4 CVEs |
before 0:3.11.117-1.git.1.dcee33f.el7 | 0:3.11.117-1.git.1.dcee33f.el7 |
jenkins-2-pluginsRed Hat:openshift:4.1::el7 From an advisory covering 3 CVEs |
before 0:4.1.1561471763-1.el7 | 0:4.1.1561471763-1.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-10320 is a medium vulnerability (CVSS 4.3) in Jenkins Credentials, published May 21, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.97%, the 62nd percentile. Fixed in org.jenkins-ci.plugins:credentials 2.1.19.
References
openwall.com/lists/oss-security/2019/05/21/1
seclists.org/fulldisclosure/2019/May/39
securityfocus.com/bid/108462
wwws.nightwatchcybersecurity.com/2019/05/23/exploring-the-file-system-via-jenkins-credentials-plugin-vulnerability-cve-2019-10320
access.redhat.com/errata/RHBA-2019:1605
Show 92 moreShow less
jenkins.io/security/advisory/2019-05-21
nvd.nist.gov/vuln/detail/CVE-2019-10320
github.com/jenkinsci/credentials-plugin/commit/40d0b5cc53c265b601ffaa4469310fad390a80fb
bugzilla.redhat.com/show_bug.cgi?id=1418021
security.access.redhat.com/data/csaf/v2/advisories/2019/rhba-2019_1605.json
cve.org/CVERecord?id=CVE-2019-10320
Left out here: 22 versions. The JSON record has them.