← Vulnerability feed

Vulnerability record · CVE-2019-10320 · published 21 May 2019

CVE-2019-10320: Jenkins credentials vulnerability

Jenkins · Credentials

Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.

4.3 CVSS 3.0 Medium EPSS 0.95% · top 40.3% CWE-538 · CWE-538
4.3CVSS 3.0 base score, v2 4.0
0.95%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
14References
17 Jun 2026Last modified by NVD

Description

Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://seclists.org/fulldisclosure/2019/May/39
http://www.openwall.com/lists/oss-security/2019/05/21/1
http://www.securityfocus.com/bid/108462
https://access.redhat.com/errata/RHBA-2019:1605
https://access.redhat.com/errata/RHSA-2019:1636
https://jenkins.io/security/advisory/2019-05-21/#SECURITY-1322 MitigationVendor Advisory
https://wwws.nightwatchcybersecurity.com/2019/05/23/exploring-the-file-system-via-jenkins-credentials-plugin-vulnerabili
http://seclists.org/fulldisclosure/2019/May/39
http://www.openwall.com/lists/oss-security/2019/05/21/1
http://www.securityfocus.com/bid/108462
https://access.redhat.com/errata/RHBA-2019:1605
https://access.redhat.com/errata/RHSA-2019:1636
https://jenkins.io/security/advisory/2019-05-21/#SECURITY-1322 MitigationVendor Advisory
https://wwws.nightwatchcybersecurity.com/2019/05/23/exploring-the-file-system-via-jenkins-credentials-plugin-vulnerabili

Track CVE-2019-10320 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2024-47805Jenkins credentials insufficiently protected credentials vulnerabilityJenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using…EPSS 0.59%6.1CVE-2021-21648Jenkins credentials cross-site scripting vulnerabilityJenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected cross-site …EPSS 11%5.4CVE-2022-29036Jenkins Credentials Plugin stored XSS via unescaped parameter namesJenkins Credentials Plugin 1111.v35a_307992395 and earlier (excluding several patched releases) fails to escape the name and description of Credentia…EPSS 79%analysed

Source: NIST National Vulnerability Database (record CVE-2019-10320), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.