PT-2019-11314 · Jenkins · Jenkins Job Import Plugin+1

Julien Szlamowicz + 1 · Published 2019-02-06 · Updated 2023-10-25 · CVE-2019-1003016

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins Job Import Plugin versions 2.1 and earlier

Description: A sensitive information exposure issue exists, allowing attackers with Overall/Read permission to have Jenkins connect to an attacker-specified URL using attacker-specified credentials IDs, capturing credentials stored in Jenkins. This is due to the plugin not checking user permissions on its API endpoint used to access remote Jenkins instances. The issue enables users with Overall/Read access to Jenkins to connect to an attacker-specified URL, potentially leading to credential capture.

Recommendations: For Jenkins Job Import Plugin versions 2.1 and earlier, update to version 3.0 or later, which will only access Jenkins instances using credentials defined in the global configuration. As a temporary workaround, consider restricting access to the plugin's API endpoint to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-1003016

GHSA-57WW-2CVR-WV38

Affected Products

Jenkins

Jenkins Job Import Plugin

References · 5

• https://osv.dev/vulnerability/GHSA-57ww-2cvr-wv38 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1003016 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1003016 · Vendor Advisory
• https://jenkins.io/security/advisory/2019-01-28/#SECURITY-905%20%282%29 · Note
• https://jenkins.io/security/advisory/2019-01-28/#SECURITY-905%20(2) · Note