PT-2019-11833 · Jenkins · Jenkins Crx Content Package Deployer Plugin+1

Oleg Nenashev · Published 2019-10-16 · Updated 2023-10-25 · CVE-2019-10439

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins CRX Content Package Deployer Plugin versions 1.8.1 and earlier Jenkins CRX Content Package Deployer Plugin versions prior to 1.9

Description A missing permission check in the Jenkins CRX Content Package Deployer Plugin in various doFillCredentialsIdItems methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.

Recommendations For Jenkins CRX Content Package Deployer Plugin versions 1.8.1 and earlier, update to version 1.9 or later to resolve the issue. For Jenkins CRX Content Package Deployer Plugin versions prior to 1.9, update to version 1.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the doFillCredentialsIdItems methods until a patch is available.

Fix

Missing Authorization

Improper Authorization

Weakness Enumeration

CWE-862

CWE-285

Related Identifiers

CVE-2019-10439

GHSA-4CMQ-88F8-53R5

Affected Products

Jenkins

Jenkins Crx Content Package Deployer Plugin

References · 7

• https://osv.dev/vulnerability/GHSA-4cmq-88f8-53r5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10439 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10439 · Vendor Advisory
• https://github.com/jenkinsci/crx-content-package-deployer-plugin/commit/06cd0e7e1b3f2fb87b3fa332ee1da710ca94b8e1 · Note
• https://github.com/jenkinsci/crx-content-package-deployer-plugin · Note
• https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1006%20%282%29 · Note
• https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1006%20(2) · Note