CVE-2019-10320 — Insertion of Sensitive Information into Externally-Accessible File or Directory in Jenkins Credentials Plugin

Description

Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins Credentials Plugin	2.1.18 and earlier	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat OpenShift 4	jenkins-2-plugins	4.1.1561471763-1.el7	RHSA-2019:1636
Red Hat OpenShift 3	atomic-enterprise-service-catalog +1	1:3.11.117-1.git.1.376e432.el7	RHBA-2019:1605
Red Hat OpenShift 3	atomic-openshift-cluster-autoscaler	3.11.117-1.git.1.caa79fa.el7	RHBA-2019:1605
Red Hat OpenShift 3	atomic-openshift-descheduler	3.11.117-1.git.1.1635b0a.el7	RHBA-2019:1605
Red Hat OpenShift 3	atomic-openshift-dockerregistry	3.11.117-1.git.1.6a42b08.el7	RHBA-2019:1605
Red Hat OpenShift 3	atomic-openshift-metrics-server	3.11.117-1.git.1.319d58e.el7	RHBA-2019:1605
Red Hat OpenShift 3	atomic-openshift-node-problem-detector	3.11.117-1.git.1.0345fe3.el7	RHBA-2019:1605
Red Hat OpenShift 3	atomic-openshift-service-idler	3.11.117-1.git.1.887bb82.el7	RHBA-2019:1605
Red Hat OpenShift 3	atomic-openshift-web-console	3.11.117-1.git.1.be7a05c.el7	RHBA-2019:1605
Red Hat OpenShift 3	cri-o	1.11.14-1.rhaos3.11.gitd56660e.el7	RHBA-2019:1605
Red Hat OpenShift 3	golang-github-openshift-oauth-proxy	3.11.117-1.git.1.2b006d2.el7	RHBA-2019:1605
Red Hat OpenShift 3	jenkins	2.164.2.1555422716-1.el7	RHBA-2019:1605
Red Hat OpenShift 3	jenkins-2-plugins	3.11.1559667994-1.el7	RHBA-2019:1605
Red Hat OpenShift 3	openshift-ansible +4	3.11.123-1.git.0.db681ba.el7	RHBA-2019:1605
Red Hat OpenShift 3	openshift-enterprise-autoheal	3.11.117-1.git.1.ef32a58.el7	RHBA-2019:1605
Red Hat OpenShift 3	openshift-enterprise-cluster-capacity	3.11.117-1.git.1.6593fce.el7	RHBA-2019:1605
Red Hat OpenShift 3	prometheus +1	3.11.117-1.git.1.f52d417.el7	RHBA-2019:1605
Red Hat OpenShift 3	prometheus-alertmanager +1	3.11.117-1.git.1.207ef35.el7	RHBA-2019:1605
Red Hat OpenShift 3	prometheus-node-exporter +1	3.11.117-1.git.1.dcee33f.el7	RHBA-2019:1605

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jenkins-ci.plugins:credentials	< 2.1.19	2.1.19	GHSA-xm94-9jw8-p6hw

Advisories 2

RHSA-2019:1636 Red Hat Security Advisory: OpenShift Container Platform 4.1 jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
RHBA-2019:1605 Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026

References

[oss-security] 20190521 Multiple vulnerabilities in Jenkins plugins mailing-list
20190524 Exploring the File System via Jenkins Credentials Plugin Vulnerability - CVE-2019-10320 mailing-list
108462 vdb-entry
https://wwws.nightwatchcybersecurity.com/2019/05/23/exploring-the-file-system-via-jenkins-credentials-plugin-vulnerability-cve-2019-10320/
RHBA-2019:1605 vendor-advisory
RHSA-2019:1636 vendor-advisory
https://jenkins.io/security/advisory/2019-05-21/#SECURITY-1322