CVE-2019-1003067

Vulnerability

The Jenkins Trac Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master [1][3]. This affects all versions of the plugin prior to the fix announced in the Jenkins Security Advisory 2019-04-03 [1]. Any job using the plugin will have its associated credentials readable in plain text within the job's configuration file.

Exploitation

An attacker needs either the 'Extended Read' permission on a job in Jenkins, or direct access to the Jenkins master file system [1][3]. No specific authentication or user interaction beyond having these permissions is required; the attacker can simply view the config.xml file of the affected job to extract the stored credentials.

Impact

Successful exploitation reveals the plaintext credentials configured for the Trac Publisher Plugin job. This leads to information disclosure of potentially sensitive credentials, compromising their confidentiality [1][3]. The attacker gains no additional privileges within Jenkins itself but can reuse the exposed credentials against other systems.

Mitigation

The Jenkins Security Advisory 2019-04-03 [1] indicates that a fix was released; users should update the Trac Publisher Plugin to the latest version that addresses this issue. Administration should also review and revoke any credentials that may have been exposed. As per the advisory, the vulnerability is addressed by the plugin update.