CVE-2019-1003072

Vulnerability

The Jenkins WildFly Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master. This affects all versions of the plugin prior to the fix released on 2019-04-03 [1][3]. The credentials are stored in plain text in the job configuration.

Exploitation

An attacker with Extended Read permission on a job, or with access to the Jenkins master file system, can view the credentials. No authentication is required beyond existing permissions. The steps involve accessing the job's config.xml file either through the Jenkins UI (with Extended Read) or direct file system access.

Impact

Successful exploitation leads to disclosure of credentials stored by the plugin, such as passwords or tokens used for WildFly deployment. This could allow an attacker to impersonate the Jenkins instance to WildFly or gain unauthorized access.

Mitigation

The Jenkins security advisory [1] was released on 2019-04-03. Users should update the WildFly Deployer Plugin to the latest version that includes encryption of credentials. Alternatively, ensure that only trusted users have Extended Read permission and restrict file system access. No specific fixed version is mentioned in the provided references.