high7.5
CVE-2019-10435
Jenkins SourceGear Vault plugin transmits credentials in plain text
Impact
Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure. As of the publication of the advisory, there are no patches and the plugin is unmaintained.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:vault-scm-plugin | <= 1.1.1 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Sourcegear Vault | through 1.1.1 |