CVE-2019-10439 - A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier in various 'doFillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins

Back Back to CVE browser

MEDIUM

A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier in various 'doFillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins

Published Oct 16, 2019

4.3

MEDIUM

CVSS 3.1

EPSS 0.66%

Description

A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier in various 'doFillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.

Affected products

Vendor Jenkins project Product Jenkins CRX Content Package Deployer Plugin Default
n/a
- Version
  1.8.1 and earlier
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Jenkins project

Jenkins CRX Content Package Deployer Plugin

n/a

Version	Status	Constraints
1.8.1 and earlier	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-285

CWE-862

Missing Authorization

References (6)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2360		Advisory
https://github.com/advisories/GHSA-4cmq-88f8-53r5		Advisory
https://github.com/jenkinsci/crx-content-package-deployer-plugin/commit/06cd0e7e1b3f2fb87b3fa332ee1da710ca94b8e1
https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1006%20%282%29		x_refsource_CONFIRM
https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1006%20(2)
https://nvd.nist.gov/vuln/detail/CVE-2019-10439