CVE-2018-1000419
published 2019-01-09CVE-2018-1000419: An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read…
PriorityP337medium6.5CVSS 3.0
AVNACLPRLUINSUCHINAN
EPSS
1.64%
73.6th percentile
An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins.
Affected
34 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| atlassian | hipchat | <= 2.2.0 | — |
| jenkins | arachni_scanner_plugin | — | — |
| jenkins | argus_notifier_plugin | — | — |
| jenkins | artifactory_plugin | — | — |
| jenkins | chatter_notifier_plugin | — | — |
| jenkins | config_file_provider_plugin | — | — |
| jenkins | credentials_plugin | — | — |
| jenkins | crowd_2_integration_plugin | — | — |
| jenkins | dimensions_plugin | — | — |
| jenkins | email_extension_template_plugin | — | — |
| jenkins | git_changelog_plugin | — | — |
| jenkins | hipchat_plugin | — | — |
| jenkins | ids_in_argus_notifier_plugin | — | — |
| jenkins | ids_in_chatter_notifier_plugin | — | — |
| jenkins | ids_in_hipchat_plugin | — | — |
| jenkins | ids_in_mesos_plugin | — | — |
| jenkins | ids_to_allow_administrators_configuring_the_plugin | — | — |
| jenkins | ids_to_allow_users_configuring_the_plugin | — | — |
| jenkins | javamelody_library_bundled_in_monitoring_plugin | — | — |
| jenkins | jira_plugin | — | — |
| jenkins | job_config_history_plugin | — | — |
| jenkins | job_configuration_history_plugin | — | — |
| jenkins | junit_plugin | — | — |
| jenkins | mesos_cloud_plugin | — | — |
| jenkins | mesos_plugin | — | — |
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Jenkins HipChat Plugin allows attackers with Overall/Read access to obtain credential IDs
ghsa·2022-05-13
CVE-2018-1000419 [MEDIUM] Jenkins HipChat Plugin allows attackers with Overall/Read access to obtain credential IDs
Jenkins HipChat Plugin allows attackers with Overall/Read access to obtain credential IDs
An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins. As of version 2.2.1, an enumeration of credentials IDs in this plugin requires Overall/Administer permission.
OSV
Jenkins HipChat Plugin allows attackers with Overall/Read access to obtain credential IDs
osv·2022-05-13
CVE-2018-1000419 [MEDIUM] Jenkins HipChat Plugin allows attackers with Overall/Read access to obtain credential IDs
Jenkins HipChat Plugin allows attackers with Overall/Read access to obtain credential IDs
An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins. As of version 2.2.1, an enumeration of credentials IDs in this plugin requires Overall/Administer permission.
Jenkins
Jenkins Security Advisory 2018-09-25
vendor_jenkins·2018-09-25·CVSS 6.5
CVE-2017-12197 [MEDIUM] Jenkins Security Advisory 2018-09-25
Title: Jenkins Security Advisory 2018-09-25
Jenkins Security Advisory 2018-09-25
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Arachni Scanner
Plugin
Argus Notifier
Plugin
Artifactory
Plugin
Chatter Notifier
Plugin
Config File Provider
Plugin
crowd2
Plugin
Dimensions
Plugin
Email Extensio
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-01-09
Published