CVE-2019-1003055

Vulnerability

The Jenkins FTP publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master [1]. Affected versions are those before the fix provided in the Jenkins Security Advisory 2019-04-03 [1]. Users with access to the Jenkins master file system can view these stored credentials [1].

Exploitation

An attacker needs access to the Jenkins master file system to read the global configuration file where the credentials are stored [1]. No authentication beyond file system access is required to view the plaintext credentials [1]. The credentials are stored without any encryption, making them directly readable [1].

Impact

Successful exploitation leads to disclosure of sensitive credentials (e.g., FTP server usernames and passwords) stored in the Jenkins FTP publisher Plugin's configuration [1]. This can compromise the security of the FTP service and any resources accessible via those credentials [1].

Mitigation

Jenkins released a security advisory on 2019-04-03 addressing this vulnerability [1]. Users should update the FTP publisher Plugin to the latest version that includes the fix [1]. As a workaround, users can restrict access to the Jenkins master file system [1]. No known KEV listing exists.