Jenkins Libvirt Slaves Plugin vlnerable to Credential Enumeration

中危 4.3CVE-2019-10473 · GHSA-8j3m-j6x6-cp5v · Published 23/10/2019 · updated 17/06/2026

要点

CVE-2019-10473 是影响 org.jenkins-ci.plugins:libvirt-slave, libvirt slaves (jenkins) 的中危 (CVSS 4.3)漏洞。
未来 30 天内被利用的概率（EPSS）：0.68%，高于 52.5% 的漏洞。
修复：升级到 1.8.6 或更高版本。

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:libvirt-slave Maven	`< 1.8.6`	`1.8.6`
libvirt slaves jenkins	`≤ 1.8.5`	No fix yet

Description

A missing permission check in Jenkins Libvirt Slaves Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.

NVD description

A missing permission check in Jenkins Libvirt Slaves Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.

References

nvd.nist.gov/vuln/detail/CVE-2019-10473 · ADVISORY
jenkinsci/libvirt-slave-plugin commit c671d68 · WEB
jenkinsci/libvirt-slave-plugin · PACKAGE
jenkinsci/libvirt-slave-plugin release · WEB
jenkins.io/security/advisory/2019-10-23 · WEB
openwall.com/lists/oss-security/2019/10/23/2 · WEB
jenkins.io/security/advisory/2019-10-23

org.jenkins-ci.plugins:libvirt-slave 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:libvirt-slave

Maven

< 1.8.6

1.8.6

libvirt slaves

jenkins

≤ 1.8.5

No fix yet

Description

A missing permission check in Jenkins Libvirt Slaves Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.

NVD description

A missing permission check in Jenkins Libvirt Slaves Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.

org.jenkins-ci.plugins:libvirt-slave 的其他漏洞

查看全部 →