CVE-2019-10378

Vulnerability

Overview The Jenkins TestLink Plugin, versions 3.16 and earlier, stores credentials unencrypted in its global configuration file on the Jenkins master [1][2]. This plaintext storage violates security best practices for credential management.

Attack

Surface and Prerequisites An attacker with access to the Jenkins master file system can view the stored credentials. This includes users who have read permissions to the configuration file, or attackers who have achieved file read access through other vulnerabilities [1][2].

Impact

Successful exploitation allows an attacker to obtain cleartext credentials configured for the TestLink plugin. These credentials can then be used to gain unauthorized access to the associated TestLink instance or other systems where the same credentials are reused [1][3].

Mitigation

As of the advisory date (2019-08-07), the vendor had not released a fix for this vulnerability in the TestLink Plugin [1][2]. Administrators should consider removing or disabling the plugin if not essential, and monitor for plugin updates. The vulnerability is listed with no resolution in the Jenkins security advisory [1].