Medium severity6.5NVD Advisory· Published Jul 31, 2019· Updated Jun 17, 2026

CVE-2019-10366

Description

Jenkins Skytap Cloud CI Plugin 2.06 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:skytapMaven	< 2.07	2.07

Affected products

ghsa-coords
pkg:maven/org.jenkins-ci.plugins/skytap
Range: < 2.07
Jenkins Project/Skytap Cloud CI Plugincpe-rescue
Range: 2.06 and earlier
Jenkins Project/Skytap Cloud Ci
cpe:2.3:a:jenkins:skytap_cloud_ci:*:*:*:*:*:jenkins:*:*
Range: <=2.06

Patches

Vulnerability mechanics

References

www.openwall.com/lists/oss-security/2019/07/31/1nvdMailing ListThird Party AdvisoryWEB
github.com/advisories/GHSA-vp26-4hj6-jrvxghsaADVISORY
jenkins.io/security/advisory/2019-07-31/nvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2019-10366ghsaADVISORY
www.zerodayinitiative.com/advisories/ZDI-19-833/nvdThird Party AdvisoryVDB Entry
github.com/jenkinsci/skytap-cloud-plugin/commit/167986a84d1d15b525eaf0232b1c1a7c47aef670ghsaWEB
www.zerodayinitiative.com/advisories/ZDI-19-833ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000