PT-2019-11832 · Jenkins · Jenkins Crx Content Package Deployer Plugin+1

Oleg Nenashev · Published 2019-10-16 · Updated 2023-10-25 · CVE-2019-10438

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins CRX Content Package Deployer Plugin versions 1.8.1 and earlier Jenkins CRX Content Package Deployer Plugin versions prior to 1.9

Description A missing permission check in the Jenkins CRX Content Package Deployer Plugin allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Recommendations For versions 1.8.1 and earlier, update to version 1.9 or later to resolve the issue. For versions prior to 1.9, update to version 1.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin for users with only Overall/Read permission until a patch is applied.

Fix

Missing Authorization

Improper Authorization

Weakness Enumeration

CWE-862

CWE-285

Related Identifiers

CVE-2019-10438

GHSA-JWW4-2793-9GMG

Affected Products

Jenkins

Jenkins Crx Content Package Deployer Plugin

References · 7

• https://osv.dev/vulnerability/GHSA-jww4-2793-9gmg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10438 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10438 · Vendor Advisory
• https://github.com/jenkinsci/crx-content-package-deployer-plugin/commit/1313c422170a064dab0f9359324ff27e30a9f4a5 · Note
• https://github.com/jenkinsci/crx-content-package-deployer-plugin · Note
• https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1006%20(1) · Note
• https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1006%20%281%29 · Note