{"id":"CVE-2019-10435","aliases":["EUVD-2022-4430","GHSA-jrmf-xhr6-3428"],"status":"published","title":"Jenkins SourceGear Vault plugin transmits credentials in plain text","description":"Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00887,"percentile":0.59715,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-319"],"published":"2019-10-01T13:45:20Z","modified":"2026-06-17T02:10:56Z","affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:vault-scm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.1.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:vault-scm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.1.1"}]}],"versions":["1.1.1"]}],"products":[{"vendor":"jenkins","product":"sourcegear_vault"},{"vendor":"jenkins project","product":"jenkins sourcegear vault plugin"}],"references":[{"url":"https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1524","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2019/10/01/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10435","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jrmf-xhr6-3428"},{"url":"https://github.com/jenkinsci/vault-scm-plugin","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2019-10435","description":"Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.","status":"published","published":"2019-10-01T13:45:20Z","modified":"2024-08-04T22:24:18.598Z","updated_at":"2026-11-02T14:20:19.399352Z"}],"euvd":[{"id":"EUVD-2022-4430","description":"Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.","status":"published","published":"2019-10-01T13:45:20Z","modified":"2024-08-04T22:24:18Z","updated_at":"2026-11-03T02:40:51.633398Z"}],"ghsa":[{"id":"GHSA-jrmf-xhr6-3428","title":"Jenkins SourceGear Vault plugin transmits credentials in plain text","description":"Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure. As of the publication of the advisory, there are no patches and the plugin is unmaintained.","status":"published","published":"2022-05-24T16:57:28Z","modified":"2023-01-31T05:02:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T14:36:29.100018Z"}],"nvd":[{"id":"CVE-2019-10435","description":"Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure.","status":"published","published":"2019-10-01T14:15:31.817Z","modified":"2026-06-17T02:10:56.1Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T14:05:30.039477Z"}],"osv":[{"id":"GHSA-jrmf-xhr6-3428","title":"Jenkins SourceGear Vault plugin transmits credentials in plain text","description":"Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure. As of the publication of the advisory, there are no patches and the plugin is unmaintained.","status":"published","published":"2022-05-24T16:57:28Z","modified":"2023-11-08T04:00:51.29575Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T15:46:51.10002Z"}]}}