Lucene search

JenkinsCVE-2019-10439

HistoryOct 16, 2019 - 2:15 p.m.

CVE-2019-10439

2019-10-1614:15:11

CWE-862

jenkins

web.nvd.nist.gov

cve-2019-10439

jenkins

crx content package deployer plugin

permission check

enumeration

security vulnerability

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.4

Confidence

High

EPSS

0.001

Percentile

22.0%

JSON

A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier in various ‘doFillCredentialsIdItems’ methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.

Affected configurations

Nvd

Node

jenkinscrx_content_package_deployerRange≤1.8.1jenkins

VendorProductVersionCPE
jenkinscrx_content_package_deployer*cpe:2.3:a:jenkins:crx_content_package_deployer:*:*:*:*:*:jenkins:*:*

Vendor	Product	Version	CPE
jenkins	crx_content_package_deployer	*	cpe:2.3:a:jenkins:crx_content_package_deployer::::::jenkins::*

CNA Affected

[
  {
    "product": "Jenkins CRX Content Package Deployer Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "status": "affected",
        "version": "1.8.1 and earlier"
      }
    ]
  }
]

References

jenkins.io/security/advisory/2019-10-16/#SECURITY-1006%20%282%29

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.4

Confidence

High

EPSS

0.001

Percentile

22.0%

JSON

Related for CVE-2019-10439