En bref
- CVE-2019-1003016 est une vulnérabilité ÉLEVÉE (CVSS 8.8) touchant org.jenkins-ci.plugins:job-import-plugin, job import (jenkins).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.91%, plus élevée que 60.0% des vulnérabilités.
- Correctif : mettre à jour vers 3.0 ou plus récent.
Description
Jenkins Job Import Plugin did not check user permissions on its API endpoint used to access remote Jenkins instances. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Job Import Plugin 3.0 will only access Jenkins instances using credentials defined in the global configuration.
NVD description
An exposure of sensitive information vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/JobImportAction.java, src/main/java/org/jenkins/ci/plugins/jobimport/JobImportGlobalConfig.java, src/main/java/org/jenkins/ci/plugins/jobimport/model/JenkinsSite.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Autres vulnérabilités de org.jenkins-ci.plugins:job-import-plugin
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free