Improper authorization vulnerability in Jenkins Mesos Plugin

MEDIUM 6.5CVE-2018-1000420 · GHSA-23xr-9xxr-vg3c · Published 09/01/2019 · updated 17/06/2026

In short

CVE-2018-1000420 is a MEDIUM (CVSS 6.5) vulnerability affecting org.jenkins-ci.plugins:mesos, mesos (apache).
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 73.4% of all vulnerabilities.
Fix: update to 0.18 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:mesos Maven	`< 0.18`	`0.18`
mesos apache	`≤ 0.17.1`	No fix yet

Description

An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2018-1000420 · ADVISORY
jenkins.io/security/advisory/2018-09-25 · WEB
securityfocus.com/bid/106532 · WEB
jenkins.io/security/advisory/2018-09-25

More vulnerabilities in org.jenkins-ci.plugins:mesos

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free