Incorrect Authorization in Puppet Enterprise Pipeline Jenkins Plugin

CRITICAL 9.9CVE-2019-10458 · GHSA-mj9c-vjp9-pggh · Published 16/10/2019 · updated 17/06/2026

In short

CVE-2019-10458 is a CRITICAL (CVSS 9.9) vulnerability affecting org.jenkins-ci.plugins.workflow:puppet-enterprise-pipeline, puppet enterprise pipeline (jenkins).
Chance of exploitation in the next 30 days (EPSS): 1.9%, higher than 80.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins.workflow:puppet-enterprise-pipeline Maven	`≤ 1.3.1`	No fix yet
puppet enterprise pipeline jenkins	`≤ 1.3.1`	No fix yet

Description

Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2019-10458 · ADVISORY
jenkinsci/puppet-enterprise-pipeline-plugin · PACKAGE
jenkins.io/security/advisory/2019-10-16 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free