CVE-2019-1003055: Jenkins FTP publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins...

Security readout for executives and security teams

This Jenkins plugin stored FTP credentials in clear text on the Jenkins master. Anyone who could access the master file system could read those credentials. The main business risk is exposure of deployment or publishing accounts, not evidence of a remotely exploitable Jenkins takeover. Exposure is likely limited to Jenkins environments using the FTP publisher Plugin, especially where multiple users, agents, backups, or administrators can read the Jenkins master file system. Treat as a credential exposure issue. Prioritize remediation where Jenkins publishes production artifacts, uses shared FTP accounts, or has broad administrator or file-system access. Mitigation focus: Check current Jenkins vendor guidance for the plugin and any replacement or fixed release.; Restrict Jenkins master file system access to only trusted administrators and service accounts.; Rotate FTP credentials stored by the plugin if file system exposure is possible..

Prepared

Jun 6, 2026, 21:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.