VYPR
← All advisories
Moderate severityNVD Advisory· Published Oct 16, 2019· Updated Aug 4, 2024

CVE-2019-10449

CVE-2019-10449

Description

Jenkins Fortify on Demand Plugin stores credentials unencrypted in job config.xml, exposing them to users with Extended Read or file system access.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Jenkins Fortify on Demand Plugin stores credentials unencrypted in job config.xml, exposing them to users with Extended Read or file system access.

Vulnerability

Jenkins Fortify on Demand Plugin stores credentials unencrypted in job config.xml files on the Jenkins master [1]. This includes the personal access token, client secret, and other authentication secrets [2]. The plugin does not use Jenkins' built-in Secret encryption mechanism, leaving credentials in plain text.

Exploitation

Users with Extended Read permission on a job or access to the Jenkins master file system can view the job config.xml file and retrieve the stored credentials [1]. No special privileges beyond those are required. The credentials are visible as plain text strings in the XML configuration.

Impact

An attacker who gains access to these credentials can authenticate to Fortify on Demand services as the victim, potentially accessing sensitive application security data, managing scans, or performing actions with the victim's privileges [1][2].

Mitigation

The fix implemented in commits [3] and [4] changes credential fields to use the hudson.util.Secret class, which encrypts the stored values. The plugin version containing the fix should be applied. Users are advised to upgrade to the latest version of the Fortify on Demand Plugin and also ensure Jenkins master file system access is restricted [1].

References
  1. Jenkins Security Advisory 2019-10-16
  2. NVD - CVE-2019-10449
  3. Merge pull request #85 from daniel-beck/SECURITY-1433 · jenkinsci/fortify-on-demand-uploader-plugin@83b2366
  4. Address SECURITY-1433 leftovers · jenkinsci/fortify-on-demand-uploader-plugin@2776420

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.jenkins-ci.plugins:fortify-on-demand-uploaderMaven
< 5.0.05.0.0

Affected products

2

Patches

2
83b23662dc0c

Merge pull request #85 from daniel-beck/SECURITY-1433

https://github.com/jenkinsci/fortify-on-demand-uploader-plugintimsotackNov 6, 2019via ghsa
commit
3 files changed · +10 −10
  • src/main/java/org/jenkinsci/plugins/fodupload/controllers/StaticScanController.java+0 −2 modified
    @@ -12,8 +12,6 @@
 import org.jenkinsci.plugins.fodupload.models.JobModel;
 import org.jenkinsci.plugins.fodupload.models.response.GenericErrorResponse;
 import org.jenkinsci.plugins.fodupload.models.response.PostStartScanResponse;
-import org.jenkinsci.plugins.fodupload.models.response.ReleaseAssessmentTypeDTO;
-import sun.applet.Main;
 
 import java.io.File;
 import java.io.FileInputStream;
  • src/main/java/org/jenkinsci/plugins/fodupload/PollingBuildStep.java+5 −4 modified
    @@ -16,6 +16,7 @@
 import hudson.tasks.Recorder;

 import hudson.util.FormValidation;

 import hudson.util.ListBoxModel;

+import hudson.util.Secret;

 import jenkins.model.GlobalConfiguration;

 import jenkins.tasks.SimpleBuildStep;

 import org.jenkinsci.plugins.fodupload.polling.PollReleaseStatusResult;

@@ -48,13 +49,13 @@ public PollingBuildStep(String bsiToken,
                             String clientId,

                             String clientSecret,

                             String username,

-                            String personalAccessToken,

+                            Secret personalAccessToken,

                             String tenantId) {

 

         sharedBuildStep = new SharedPollingBuildStep(bsiToken,

                 overrideGlobalConfig, pollingInterval,

                 policyFailureBuildResultPreference, clientId, clientSecret,

-                username, personalAccessToken, tenantId);

+                username, personalAccessToken.getEncryptedValue(), tenantId);

     }

 

     @Override

@@ -93,8 +94,8 @@ public String getUsername() {
     }

 

     @SuppressWarnings("unused")

-    public String getPersonalAccessToken() {

-        return sharedBuildStep.getAuthModel().getPersonalAccessToken();

+    public Secret getPersonalAccessToken() {

+        return Secret.fromString(sharedBuildStep.getAuthModel().getPersonalAccessToken());

     }

 

     @SuppressWarnings("unused")
  • src/main/java/org/jenkinsci/plugins/fodupload/StaticAssessmentBuildStep.java+5 −4 modified
    @@ -15,6 +15,7 @@
 import hudson.tasks.Recorder;
 import hudson.util.FormValidation;
 import hudson.util.ListBoxModel;
+import hudson.util.Secret;
 import jenkins.tasks.SimpleBuildStep;
 import org.jenkinsci.plugins.fodupload.models.JobModel;
 import org.kohsuke.stapler.DataBoundConstructor;
@@ -44,7 +45,7 @@ public class StaticAssessmentBuildStep extends Recorder implements SimpleBuildSt
     public StaticAssessmentBuildStep(String bsiToken,
                                      boolean overrideGlobalConfig,
                                      String username,
-                                     String personalAccessToken,
+                                     Secret personalAccessToken,
                                      String tenantId,
                                      boolean purchaseEntitlements,
                                      String entitlementPreference,
@@ -55,7 +56,7 @@ public StaticAssessmentBuildStep(String bsiToken,
         sharedBuildStep = new SharedUploadBuildStep(bsiToken,
                 overrideGlobalConfig,
                 username,
-                personalAccessToken,
+                personalAccessToken.getEncryptedValue(),
                 tenantId,
                 purchaseEntitlements,
                 entitlementPreference,
@@ -107,8 +108,8 @@ public String getUsername() {
     }
 
     @SuppressWarnings("unused")
-    public String getPersonalAccessToken() {
-        return sharedBuildStep.getAuthModel().getPersonalAccessToken();
+    public Secret getPersonalAccessToken() {
+        return Secret.fromString(sharedBuildStep.getAuthModel().getPersonalAccessToken());
     }
 
     @SuppressWarnings("unused")
277642040362

Address SECURITY-1433 leftovers

https://github.com/jenkinsci/fortify-on-demand-uploader-pluginDaniel BeckNov 5, 2019via ghsa
commit
3 files changed · +10 −10
  • src/main/java/org/jenkinsci/plugins/fodupload/controllers/StaticScanController.java+0 −2 modified
    @@ -12,8 +12,6 @@
 import org.jenkinsci.plugins.fodupload.models.JobModel;
 import org.jenkinsci.plugins.fodupload.models.response.GenericErrorResponse;
 import org.jenkinsci.plugins.fodupload.models.response.PostStartScanResponse;
-import org.jenkinsci.plugins.fodupload.models.response.ReleaseAssessmentTypeDTO;
-import sun.applet.Main;
 
 import java.io.File;
 import java.io.FileInputStream;
  • src/main/java/org/jenkinsci/plugins/fodupload/PollingBuildStep.java+5 −4 modified
    @@ -16,6 +16,7 @@
 import hudson.tasks.Recorder;

 import hudson.util.FormValidation;

 import hudson.util.ListBoxModel;

+import hudson.util.Secret;

 import jenkins.model.GlobalConfiguration;

 import jenkins.tasks.SimpleBuildStep;

 import org.jenkinsci.plugins.fodupload.polling.PollReleaseStatusResult;

@@ -48,13 +49,13 @@ public PollingBuildStep(String bsiToken,
                             String clientId,

                             String clientSecret,

                             String username,

-                            String personalAccessToken,

+                            Secret personalAccessToken,

                             String tenantId) {

 

         sharedBuildStep = new SharedPollingBuildStep(bsiToken,

                 overrideGlobalConfig, pollingInterval,

                 policyFailureBuildResultPreference, clientId, clientSecret,

-                username, personalAccessToken, tenantId);

+                username, personalAccessToken.getEncryptedValue(), tenantId);

     }

 

     @Override

@@ -93,8 +94,8 @@ public String getUsername() {
     }

 

     @SuppressWarnings("unused")

-    public String getPersonalAccessToken() {

-        return sharedBuildStep.getAuthModel().getPersonalAccessToken();

+    public Secret getPersonalAccessToken() {

+        return Secret.fromString(sharedBuildStep.getAuthModel().getPersonalAccessToken());

     }

 

     @SuppressWarnings("unused")
  • src/main/java/org/jenkinsci/plugins/fodupload/StaticAssessmentBuildStep.java+5 −4 modified
    @@ -15,6 +15,7 @@
 import hudson.tasks.Recorder;
 import hudson.util.FormValidation;
 import hudson.util.ListBoxModel;
+import hudson.util.Secret;
 import jenkins.tasks.SimpleBuildStep;
 import org.jenkinsci.plugins.fodupload.models.JobModel;
 import org.kohsuke.stapler.DataBoundConstructor;
@@ -44,7 +45,7 @@ public class StaticAssessmentBuildStep extends Recorder implements SimpleBuildSt
     public StaticAssessmentBuildStep(String bsiToken,
                                      boolean overrideGlobalConfig,
                                      String username,
-                                     String personalAccessToken,
+                                     Secret personalAccessToken,
                                      String tenantId,
                                      boolean purchaseEntitlements,
                                      String entitlementPreference,
@@ -55,7 +56,7 @@ public StaticAssessmentBuildStep(String bsiToken,
         sharedBuildStep = new SharedUploadBuildStep(bsiToken,
                 overrideGlobalConfig,
                 username,
-                personalAccessToken,
+                personalAccessToken.getEncryptedValue(),
                 tenantId,
                 purchaseEntitlements,
                 entitlementPreference,
@@ -107,8 +108,8 @@ public String getUsername() {
     }
 
     @SuppressWarnings("unused")
-    public String getPersonalAccessToken() {
-        return sharedBuildStep.getAuthModel().getPersonalAccessToken();
+    public Secret getPersonalAccessToken() {
+        return Secret.fromString(sharedBuildStep.getAuthModel().getPersonalAccessToken());
     }
 
     @SuppressWarnings("unused")

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.