CVE-2019-10433

3.3 lowEPSS 0.4%

Jenkins Dingding[钉钉] Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Severity

CVSS 3.1

3.3 low

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
CWE: CWE-312
Published: 2019-10-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

jenkins:dingding

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-xg8p-cp7f-cphx	Maven	io.jenkins.plugins:dingding-notifications	<2.0.0	2.0.0

References

http://www.openwall.com/lists/oss-security/2019/10/01/2
https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1423
https://www.zerodayinitiative.com/advisories/ZDI-19-862/
http://www.openwall.com/lists/oss-security/2019/10/01/2
https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1423

Check your stack JSON