CVE-2018-1000419 - An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins

Back Back to CVE browser

MEDIUM

An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins

Published Jan 9, 2019

6.5

MEDIUM

CVSS 3.0

EPSS 1.64%

Description

An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (6)

http://www.securityfocus.com/bid/106532
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2959
Advisory
https://github.com/advisories/GHSA-798p-53r7-mgw9
Advisory
https://jenkins.io/security/advisory/2018-09-25/#SECURITY-984%20%282%29
x_refsource_CONFIRM
https://jenkins.io/security/advisory/2018-09-25/#SECURITY-984%20(2)
https://nvd.nist.gov/vuln/detail/CVE-2018-1000419

Link	Providers	Tags
http://www.securityfocus.com/bid/106532		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2959		Advisory
https://github.com/advisories/GHSA-798p-53r7-mgw9		Advisory
https://jenkins.io/security/advisory/2018-09-25/#SECURITY-984%20%282%29		x_refsource_CONFIRM
https://jenkins.io/security/advisory/2018-09-25/#SECURITY-984%20(2)
https://nvd.nist.gov/vuln/detail/CVE-2018-1000419