CVE-2019-1003095: Jenkins Perfecto Mobile Plugin stores credentials unencrypted in its global configuration file on the Jenki...

Security readout for executives and security teams

Jenkins Perfecto Mobile Plugin stored Perfecto credentials in clear text on the Jenkins master. Someone who can access the Jenkins master file system could read those credentials and potentially use them outside Jenkins. The issue is serious where Jenkins hosts are shared, loosely administered, or have broad filesystem access. Exposure is limited to Jenkins environments that installed the Perfecto Mobile Plugin, all versions as of April 3, 2019. Risk depends on who can access the Jenkins master filesystem and whether stored Perfecto credentials remain valid. Treat as a targeted credential-exposure risk, not a broad remote compromise. Prioritize Jenkins systems with shared administration, weak host access controls, or high-value Perfecto credentials. Mitigation focus: Check Jenkins advisory and plugin vendor guidance for fixed or replacement versions.; Restrict Jenkins master filesystem access to trusted administrators only.; Rotate Perfecto credentials stored through the plugin if exposure is possible..

Prepared

Jun 6, 2026, 21:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.