Not rated
CVE-2019-1003016 An exposure of sensitive information vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in…
Description
An exposure of sensitive information vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/JobImportAction.java, src/main/java/org/jenkins/ci/plugins/jobimport/JobImportGlobalConfig.java, src/main/java/org/jenkins/ci/plugins/jobimport/model/JenkinsSite.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins Job Import Plugin | Versions not published |
Other CVEs of Jenkins Job Import Plugin
The 5 CVEs of Jenkins Job Import Plugin →
CVE-2026-48926
Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in an HTTP endpoint,…
4.3
Medium
CVE-2022-43413
Jenkins Job Import Plugin 3.5 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers…
4.3
Medium
CVE-2019-1003015
An XML external entity processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in…
Not rated
CVE-2019-1003017
A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that…
Not rated