PT-2019-11741 · Jenkins · Jenkins Docker Plugin+1

Published 2019-07-11 · Updated 2023-10-25 · CVE-2019-10342

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Docker Plugin versions 1.1.6 and earlier

Description A missing permission check in the Jenkins Docker Plugin allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. This issue is related to various 'fillCredentialsIdItems' methods.

Recommendations For Jenkins Docker Plugin versions 1.1.6 and earlier, consider restricting access to the 'fillCredentialsIdItems' methods until a patch is available. As a temporary workaround, review and restrict Overall/Read access to minimize the risk of credentials enumeration. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2019-10342

GHSA-745W-V492-4FJ5

Affected Products

Jenkins

Jenkins Docker Plugin

References · 6

• https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1400 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10342 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10342 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-745w-v492-4fj5 · Vendor Advisory
• http://openwall.com/lists/oss-security/2019/07/11/4 · Note
• http://securityfocus.com/bid/109156 · Note