CVE-2019-1003038

Vulnerability

The Jenkins Repository Connector Plugin versions 1.2.4 and earlier store user credentials in an insufficiently protected manner within the plugin's configuration [1][3]. The vulnerability exists in the Java source files ArtifactDeployer.java, Repository.java, and UserPwd.java [3].

Exploitation

An attacker can exploit this vulnerability by gaining local file system access to the Jenkins controller or by controlling a Jenkins administrator's web browser (e.g., via a malicious browser extension). No authentication or user interaction is required beyond the initial access condition [1][3].

Impact

Successful exploitation allows the attacker to retrieve the password stored in the plugin configuration, leading to disclosure of credentials used by the plugin to connect to artifact repositories [3].

Mitigation

The Jenkins Security Advisory recommends upgrading the Repository Connector Plugin to a version that does not persist passwords in an insufficiently protected manner. The advisory was published on 2019-03-06 [1]. Users should follow the plugin's upgrade path and check for the latest fixed version. No workaround is documented in the available references.