CVE-2019-10460

7.8 highEPSS 0.3%

Jenkins Bitbucket OAuth Plugin 0.9 and earlier stored credentials unencrypted in the global config.xml configuration file on the Jenkins master where they could be viewed by users with access to the master file system.

Severity

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 26% of CVEs (scores of 2026-10-31)
CWE: CWE-522
Published: 2019-10-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

jenkins:bitbucket_oauth

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-84h6-jf8x-ff2j	Maven	org.jenkins-ci.plugins:bitbucket-oauth	<0.10	0.10

References

http://www.openwall.com/lists/oss-security/2019/10/23/2
https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1546
http://www.openwall.com/lists/oss-security/2019/10/23/2
https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1546

Check your stack JSON