CVE-2019-10318

Jenkins Azure AD Plugin 0.3.3 and earlier stored the client secret unencrypted in the global config.xml configuration file on the Jenkins master where it could be viewed by users with access to the master file system.

• CWE-522

• http://www.openwall.com/lists/oss-security/2019/04/30/5Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/108159Third Party Advisory, VDB Entry
• https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1390Vendor Advisory
• http://www.openwall.com/lists/oss-security/2019/04/30/5Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/108159Third Party Advisory, VDB Entry
• https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1390Vendor Advisory

Published

Apr 30, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10312A missing permission check in Jenkins Ansible Tower Plugin 0…4.3
• CVE-2019-10313Jenkins Twitter Plugin stores credentials unencrypted in its…8.8
• CVE-2019-10314Jenkins Koji Plugin disables SSL/TLS and hostname verificati…
• CVE-2019-10315Jenkins GitHub Authentication Plugin 0.31 and earlier did no…
• CVE-2019-10316Jenkins Aqua MicroScanner Plugin 1.0.5 and earlier stored cr…8.8
• CVE-2019-10317Jenkins SiteMonitor Plugin 0.5 and earlier disabled SSL/TLS …
• CVE-2019-10319A missing permission check in Jenkins PAM Authentication Plu…4.3
• CVE-2019-1032A cross-site-scripting (XSS) vulnerability exists when Micro…
• CVE-2019-10320Jenkins Credentials Plugin 2.1.18 and earlier allowed users …
• CVE-2019-10321A cross-site request forgery vulnerability in Jenkins Artifa…
• CVE-2019-10322A missing permission check in Jenkins Artifactory Plugin 3.2…4.3
• CVE-2019-10323A missing permission check in Jenkins Artifactory Plugin 3.2…4.3