Jenkins Job Import Plugin vulnerable to exposure of sensitive information

高 8.8CVE-2019-1003016 · GHSA-57ww-2cvr-wv38 · 06/02/2019 公開 · 17/06/2026 更新

要点

CVE-2019-1003016 は org.jenkins-ci.plugins:job-import-plugin, job import (jenkins) に影響する深刻度「高」 (CVSS 8.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.91%（全脆弱性の 59.9% より高い）。
対処：3.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.jenkins-ci.plugins:job-import-plugin Maven	`< 3.0`	`3.0`
job import jenkins	`≤ 2.1`	修正版なし

概要

Jenkins Job Import Plugin did not check user permissions on its API endpoint used to access remote Jenkins instances. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Job Import Plugin 3.0 will only access Jenkins instances using credentials defined in the global configuration.

NVD の説明

An exposure of sensitive information vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/JobImportAction.java, src/main/java/org/jenkins/ci/plugins/jobimport/JobImportGlobalConfig.java, src/main/java/org/jenkins/ci/plugins/jobimport/model/JenkinsSite.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.