Every CVE Search/ Get API key

CVE-2019-16541

Jenkins JIRA Plugin allows users to select and use credentials with System scope

9.9 CriticalFix available

Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct (folder) scope for per-folder Jira site definitions, allowing users to select and use credentials with System scope.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.68%Up 1.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.9

Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct (folder) scope for per-folder Jira site definitions, allowing users to select and use credentials with System scope.

Record
CVE-2019-16541
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0
6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness
CWE-668
Updated
2026-11-02
CVE List No score

Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct (folder) scope for per-folder Jira site definitions, allowing users to select and use credentials with System scope.

Record
CVE-2019-16541
Updated
2026-11-02
EUVDEUVD-2022-3327 No score

Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct (folder) scope for per-folder Jira site definitions, allowing users to select and use credentials with System scope.

Record
EUVD-2022-3327
Updated
2026-11-03
GitHub AdvisoriesGHSA-98m4-m2c3-qxgq 6.5

Jenkins JIRA Plugin allows users to select and use credentials with System scope

Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct (folder) scope for per-folder Jira site definitions, allowing users to select and use credentials with System scope. Jira Plugin 3.0.11 defines the appropriate folder context for credential lookup. As a side effect, existing per-folder Jira sites may lose access to already configured System-scoped credentials, as if no credential was specified in the first place.

Record
GHSA-98m4-m2c3-qxgq
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-668
Updated
2026-11-02
OSV 9.9

Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct (folder) scope for per-folder Jira site definitions, allowing users to select and use credentials with System scope.

Record
CVE-2019-16541
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-98m4-m2c3-qxgq 6.5

Jenkins JIRA Plugin allows users to select and use credentials with System scope

Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct (folder) scope for per-folder Jira site definitions, allowing users to select and use credentials with System scope. Jira Plugin 3.0.11 defines the appropriate folder context for credential lookup. As a side effect, existing per-folder Jira sites may lose access to already configured System-scoped credentials, as if no credential was specified in the first place.

Record
GHSA-98m4-m2c3-qxgq
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-668
Updated
2026-11-02
OSVRHSA-2020:3541 8.0

Red Hat Security Advisory: OpenShift Container Platform 3.11 security update

Record
RHSA-2020:3541
CVSS 3.1
8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2020:4297 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.6.1 package security update

Record
RHSA-2020:4297
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.jenkins-ci.plugins:jira
Maven
 through 3.0.10
3.0.11
org.jenkins-ci.plugins:jira
Maven
 before 3.0.11, plus listed versions
1.271.281.291.301.31
Show 34 moreShow less
1.321.331.341.351.361.371.381.391.412.02.0.22.0.32.12.22.2.12.32.3.12.42.4.22.52.5.12.5.23.0.03.0.13.0.103.0.23.0.33.0.43.0.53.0.63.0.6.13.0.73.0.83.0.9
3.0.11
jenkins-2-plugins
Red Hat:openshift:3.11::el7
 before 0:3.11.1597310986-1.el7
0:3.11.1597310986-1.el7
openshift-ansible
Red Hat:openshift:3.11::el7
 before 0:3.11.272-1.git.0.79ab6e9.el7
0:3.11.272-1.git.0.79ab6e9.el7
openshift-ansible-docs
Red Hat:openshift:3.11::el7
 before 0:3.11.272-1.git.0.79ab6e9.el7
0:3.11.272-1.git.0.79ab6e9.el7
openshift-ansible-playbooks
Red Hat:openshift:3.11::el7
 before 0:3.11.272-1.git.0.79ab6e9.el7
0:3.11.272-1.git.0.79ab6e9.el7
openshift-ansible-roles
Red Hat:openshift:3.11::el7
 before 0:3.11.272-1.git.0.79ab6e9.el7
0:3.11.272-1.git.0.79ab6e9.el7
openshift-ansible-test
Red Hat:openshift:3.11::el7
 before 0:3.11.272-1.git.0.79ab6e9.el7
0:3.11.272-1.git.0.79ab6e9.el7
jenkins
Red Hat:openshift:3.11::el7
 before 0:2.235.2.1597220898-1.el7
0:2.235.2.1597220898-1.el7
python-rsa
Red Hat:openshift:3.11::el7
 before 0:4.5-2.el7
0:4.5-2.el7
Show 23 moreShow less
Affected packages
PackageAffectedFixed
python2-rsa
Red Hat:openshift:3.11::el7
 before 0:4.5-2.el7
0:4.5-2.el7
jenkins-2-plugins
Red Hat:openshift:4.6::el8
 before 0:4.6.1601368321-1.el8
0:4.6.1601368321-1.el8
openshift-clients
Red Hat:openshift:4.6::el7
 before 0:4.6.0-202010081244.p0.git.3794.4743d24.el7
0:4.6.0-202010081244.p0.git.3794.4743d24.el7
openshift-clients-redistributable
Red Hat:openshift:4.6::el7
 before 0:4.6.0-202010081244.p0.git.3794.4743d24.el7
0:4.6.0-202010081244.p0.git.3794.4743d24.el7
openshift-clients
Red Hat:openshift:4.6::el8
 before 0:4.6.0-202010081244.p0.git.3794.4743d24.el8
0:4.6.0-202010081244.p0.git.3794.4743d24.el8
openshift-clients-redistributable
Red Hat:openshift:4.6::el8
 before 0:4.6.0-202010081244.p0.git.3794.4743d24.el8
0:4.6.0-202010081244.p0.git.3794.4743d24.el8
containers-common
Red Hat:openshift:4.6::el8
 before 1:1.1.1-2.rhaos4.6.el8
1:1.1.1-2.rhaos4.6.el8
podman
Red Hat:openshift:4.6::el8
 before 0:1.9.3-3.rhaos4.6.el8
0:1.9.3-3.rhaos4.6.el8
podman-debuginfo
Red Hat:openshift:4.6::el8
 before 0:1.9.3-3.rhaos4.6.el8
0:1.9.3-3.rhaos4.6.el8
podman-debugsource
Red Hat:openshift:4.6::el8
 before 0:1.9.3-3.rhaos4.6.el8
0:1.9.3-3.rhaos4.6.el8
podman-docker
Red Hat:openshift:4.6::el8
 before 0:1.9.3-3.rhaos4.6.el8
0:1.9.3-3.rhaos4.6.el8
podman-remote
Red Hat:openshift:4.6::el8
 before 0:1.9.3-3.rhaos4.6.el8
0:1.9.3-3.rhaos4.6.el8
podman-remote-debuginfo
Red Hat:openshift:4.6::el8
 before 0:1.9.3-3.rhaos4.6.el8
0:1.9.3-3.rhaos4.6.el8
podman-tests
Red Hat:openshift:4.6::el8
 before 0:1.9.3-3.rhaos4.6.el8
0:1.9.3-3.rhaos4.6.el8
skopeo
Red Hat:openshift:4.6::el8
 before 1:1.1.1-2.rhaos4.6.el8
1:1.1.1-2.rhaos4.6.el8
skopeo-debuginfo
Red Hat:openshift:4.6::el8
 before 1:1.1.1-2.rhaos4.6.el8
1:1.1.1-2.rhaos4.6.el8
skopeo-debugsource
Red Hat:openshift:4.6::el8
 before 1:1.1.1-2.rhaos4.6.el8
1:1.1.1-2.rhaos4.6.el8
skopeo-tests
Red Hat:openshift:4.6::el8
 before 1:1.1.1-2.rhaos4.6.el8
1:1.1.1-2.rhaos4.6.el8
runc
Red Hat:openshift:4.6::el7
 before 0:1.0.0-81.rhaos4.6.git5b757d4.el7
0:1.0.0-81.rhaos4.6.git5b757d4.el7
runc-debuginfo
Red Hat:openshift:4.6::el7
 before 0:1.0.0-81.rhaos4.6.git5b757d4.el7
0:1.0.0-81.rhaos4.6.git5b757d4.el7
runc
Red Hat:openshift:4.6::el8
 before 0:1.0.0-81.rhaos4.6.git5b757d4.el8
0:1.0.0-81.rhaos4.6.git5b757d4.el8
runc-debuginfo
Red Hat:openshift:4.6::el8
 before 0:1.0.0-81.rhaos4.6.git5b757d4.el8
0:1.0.0-81.rhaos4.6.git5b757d4.el8
runc-debugsource
Red Hat:openshift:4.6::el8
 before 0:1.0.0-81.rhaos4.6.git5b757d4.el8
0:1.0.0-81.rhaos4.6.git5b757d4.el8

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-16541 is a critical vulnerability (CVSS 9.9) in Jenkins Jira, published November 21, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.68%, the 76th percentile. Fixed in org.jenkins-ci.plugins:jira 3.0.11.

References

Show 85 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open