CVE-2018-1000412
published 2019-01-09CVE-2018-1000412: An improper authorization vulnerability exists in Jenkins Jira Plugin 3.0.1 and earlier in JiraSite.java that allows attackers with Overall/Read access to have…
high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
An improper authorization vulnerability exists in Jenkins Jira Plugin 3.0.1 and earlier in JiraSite.java that allows attackers with Overall/Read access to have Jenkins connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected
34 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | arachni_scanner_plugin | — | — |
| jenkins | argus_notifier_plugin | — | — |
| jenkins | artifactory_plugin | — | — |
| jenkins | chatter_notifier_plugin | — | — |
| jenkins | config_file_provider_plugin | — | — |
| jenkins | credentials_plugin | — | — |
| jenkins | crowd_2_integration_plugin | — | — |
| jenkins | dimensions_plugin | — | — |
| jenkins | email_extension_template_plugin | — | — |
| jenkins | git_changelog_plugin | — | — |
| jenkins | hipchat_plugin | — | — |
| jenkins | ids_in_argus_notifier_plugin | — | — |
| jenkins | ids_in_chatter_notifier_plugin | — | — |
| jenkins | ids_in_hipchat_plugin | — | — |
| jenkins | ids_in_mesos_plugin | — | — |
| jenkins | ids_to_allow_administrators_configuring_the_plugin | — | — |
| jenkins | ids_to_allow_users_configuring_the_plugin | — | — |
| jenkins | javamelody_library_bundled_in_monitoring_plugin | — | — |
| jenkins | jira | <= 3.0.1 | — |
| jenkins | jira_plugin | — | — |
| jenkins | job_config_history_plugin | — | — |
| jenkins | job_configuration_history_plugin | — | — |
| jenkins | junit_plugin | — | — |
| jenkins | mesos_cloud_plugin | — | — |
| jenkins | mesos_plugin | — | — |