Not rated

CVE-2019-10341 A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection…

Description

A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins Docker Plugin	Versions not published

The 3 CVEs of Jenkins Docker Plugin →

CVE-2019-10340 A cross-site request forgery vulnerability in Jenkins Docker Plugin 1.1.6 and earlier in… Not rated CVE-2019-10342 A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in various 'fillCredentialsIdItems' methods… Not rated

Do you use Jenkins Docker Plugin?

Track this CVE Watch Jenkins Docker Plugin Check my SBOMs

www.cveye.io/en/cve/CVE-2019-10341

Timeline

Published July 11, 2019
Last modified August 4, 2024

References

[oss-security] 20190711 Multiple vulnerabilities in Jenkins plugins www.openwall.com
109156 www.securityfocus.com
jenkins.io jenkins.io

Track this CVE

CVE-2019-10341 A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection…

Description

Affected products and versions

Other CVEs of Jenkins Docker Plugin