#VU21525 Cleartext transmission of sensitive information in LDAP Email - CVE-2019-10434

Vulnerability identifier: #VU21525

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-10434

CWE-ID: CWE-319

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
LDAP Email
Web applications / Modules and components for CMS

Vendor: Jenkins

Description

The vulnerability allows a remote attacker to view a password on the target system.

The vulnerability exists due to the affected software stores an LDAP bind password in its global Jenkins configuration. While the password is stored encrypted on disk, it is transmitted in plain text as part of the configuration form. A remote attacker with ability to intercept network traffic can obtain the password.

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

LDAP Email: 0.1 - 0.8

---

External links
https://www.openwall.com/lists/oss-security/2019/10/01/2
https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1515

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.