LiveActive security incident?Get immediate response
CVE Record

CVE-2018-1000104: A plaintext storage of a password vulnerability exists in Jenkins Coverity Plugin 1.10.0 and earlier in CIM...

A plaintext storage of a password vulnerability exists in Jenkins Coverity Plugin 1.10.0 and earlier in CIMInstance.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the configured keystore and private key passwords.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

Jenkins Coverity Plugin 1.10.0 and earlier stored configured keystore and private key passwords in plaintext. An attacker would need local filesystem access to the Jenkins environment or control of a Jenkins administrator's browser, such as through a malicious extension, to retrieve them.

Executive priority

Treat this as a credential exposure issue for affected Jenkins environments, not a broad remote compromise. Prioritize inventory, vendor-guided update, access tightening, and password rotation where sensitive build or signing material could be exposed.

Technical view

The reported flaw is plaintext password storage in CIMInstance.java in Jenkins Coverity Plugin 1.10.0 and earlier. The exposed secrets are configured keystore and private key passwords. The source bundle does not provide CVSS, CWE, fixed-version details, or evidence of exploitation in the wild.

Likely exposure

Exposure is limited to Jenkins instances using Coverity Plugin 1.10.0 or earlier with configured keystore or private key passwords. Risk increases where Jenkins home files are broadly readable or administrator browsers are not well controlled.

Exploitation context

No active exploitation is cited, and the CVE is not marked KEV. The described access path requires either local filesystem access to Jenkins-related files or control of a Jenkins administrator's web browser.

Researcher notes

Evidence is narrow but clear on affected plugin versions and exposed secret types. Missing details include CVSS, CWE, exact fixed version, and exploit prevalence. Do not assume remote exploitation without additional source support.

Mitigation direction

  • Inventory Jenkins instances for Coverity Plugin 1.10.0 or earlier.
  • Follow Jenkins advisory guidance for fixed versions or migration steps.
  • Restrict Jenkins filesystem access to required service accounts only.
  • Review Jenkins administrator browser extension policy and endpoint controls.
  • Rotate exposed keystore and private key passwords if compromise is plausible.

Validation and detection

  • Confirm whether any Jenkins instance uses Coverity Plugin 1.10.0 or earlier.
  • Identify configured keystore or private key passwords managed by the plugin.
  • Review Jenkins filesystem permissions for unauthorized local read access.
  • Assess administrator browser control risks, including untrusted extensions.
  • Check vendor advisory details before closing remediation.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2018-1000104 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.