PT-2019-11868 · Jenkins · Jenkins Global Post Script Plugin+1

Oleg Nenashev · Published 2019-10-23 · Updated 2023-10-25 · CVE-2019-10474

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Global Post Script Plugin (affected versions not specified)

Description The issue is related to a missing permission check in the Jenkins Global Post Script Plugin. This allows users with Overall/Read access to list the scripts available to the plugin stored on the Jenkins master file system. Specifically, it enables users to list the files contained in $JENKINS HOME/global-post-script that can be used by the plugin, due to the lack of permission checks on a method implementing form validation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2019-10474

GHSA-24W5-W6FW-QQX7

Affected Products

Jenkins

Jenkins Global Post Script Plugin

References · 7

• https://osv.dev/vulnerability/GHSA-24w5-w6fw-qqx7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10474 · Security Note
• https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1073 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10474 · Vendor Advisory
• https://github.com/jenkinsci/global-post-script-plugin · Note
• https://github.com/jenkinsci/global-post-script-plugin/commit/6ef4d89279fe1b4c4f19f4622294893ba7f36040 · Note
• http://openwall.com/lists/oss-security/2019/10/23/2 · Note