CVE-2019-1003075: Jenkins Audit to Database Plugin stores credentials unencrypted in its global configuration file on the Jen...

Security readout for executives and security teams

This issue exposes credentials stored by the Jenkins Audit to Database Plugin because they are kept unencrypted on the Jenkins master. The main business risk is credential reuse or database access by someone who already has filesystem access to the Jenkins master. Exposure is limited to Jenkins environments that installed the Audit to Database Plugin and stored credentials in its global configuration. Risk is higher where Jenkins master filesystem access is broadly shared, backups are widely accessible, or database credentials are reused. Treat this as a targeted credential exposure risk. It is not documented as actively exploited in the supplied sources, but Jenkins credentials can enable broader operational compromise if mishandled or reused. Mitigation focus: Check Jenkins advisory and plugin guidance for supported remediation or replacement options.; Restrict Jenkins master filesystem access to only required administrators and service accounts.; Rotate database credentials stored by the plugin if filesystem exposure is plausible..

Prepared

Jun 6, 2026, 21:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.