CVE-2019-10366

6.5 mediumEPSS 1.5%

Jenkins Skytap Cloud CI Plugin 2.06 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.5% chance of exploitation in the next 30 days; higher than 73% of CVEs (scores of 2026-10-31)
CWE: CWE-522
Published: 2019-07-31
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

jenkins:skytap_cloud_ci

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-vp26-4hj6-jrvx	Maven	org.jenkins-ci.plugins:skytap	<2.07	2.07

References

http://www.openwall.com/lists/oss-security/2019/07/31/1
https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1429
https://www.zerodayinitiative.com/advisories/ZDI-19-833/
http://www.openwall.com/lists/oss-security/2019/07/31/1
https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1429

Check your stack JSON