Jenkins Libvirt Slaves Plugin vlnerable to Incorrect Default Permissions

MÉDIO 6.5CVE-2019-10472 · GHSA-m36j-f2hf-qgj2 · Published 23/10/2019 · updated 17/06/2026

Em resumo

CVE-2019-10472 é uma vulnerabilidade MÉDIO (CVSS 6.5) que afeta org.jenkins-ci.plugins:libvirt-slave, libvirt slaves (jenkins).
Chance de exploração nos próximos 30 dias (EPSS): 0.84%, maior que 57.9% das vulnerabilidades.
Correção: atualize para 1.8.6 ou posterior.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:libvirt-slave Maven	`< 1.8.6`	`1.8.6`
libvirt slaves jenkins	`≤ 1.8.5`	No fix yet

Description

A missing permission check in Jenkins Libvirt Slaves Plugin allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2019-10472 · ADVISORY
jenkinsci/libvirt-slave-plugin commit 231c41e · WEB
jenkinsci/libvirt-slave-plugin commit c671d68 · WEB
jenkinsci/libvirt-slave-plugin · PACKAGE
jenkins.io/security/advisory/2019-10-23 · WEB
openwall.com/lists/oss-security/2019/10/23/2 · WEB
jenkins.io/security/advisory/2019-10-23

Mais vulnerabilidades de org.jenkins-ci.plugins:libvirt-slave

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:libvirt-slave

Maven

< 1.8.6

1.8.6

libvirt slaves

jenkins

≤ 1.8.5

No fix yet

Description

NVD description

Mais vulnerabilidades de org.jenkins-ci.plugins:libvirt-slave

Ver tudo →