CVE-2018-1000420
published 2019-01-09CVE-2018-1000420: An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to…
PriorityP336medium6.5CVSS 3.0
AVNACLPRLUINSUCHINAN
EPSS
1.45%
70.4th percentile
An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins.
Affected
34 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | mesos | <= 0.17.1 | — |
| jenkins | arachni_scanner_plugin | — | — |
| jenkins | argus_notifier_plugin | — | — |
| jenkins | artifactory_plugin | — | — |
| jenkins | chatter_notifier_plugin | — | — |
| jenkins | config_file_provider_plugin | — | — |
| jenkins | credentials_plugin | — | — |
| jenkins | crowd_2_integration_plugin | — | — |
| jenkins | dimensions_plugin | — | — |
| jenkins | email_extension_template_plugin | — | — |
| jenkins | git_changelog_plugin | — | — |
| jenkins | hipchat_plugin | — | — |
| jenkins | ids_in_argus_notifier_plugin | — | — |
| jenkins | ids_in_chatter_notifier_plugin | — | — |
| jenkins | ids_in_hipchat_plugin | — | — |
| jenkins | ids_in_mesos_plugin | — | — |
| jenkins | ids_to_allow_administrators_configuring_the_plugin | — | — |
| jenkins | ids_to_allow_users_configuring_the_plugin | — | — |
| jenkins | javamelody_library_bundled_in_monitoring_plugin | — | — |
| jenkins | jira_plugin | — | — |
| jenkins | job_config_history_plugin | — | — |
| jenkins | job_configuration_history_plugin | — | — |
| jenkins | junit_plugin | — | — |
| jenkins | mesos_cloud_plugin | — | — |
| jenkins | mesos_plugin | — | — |
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Improper authorization vulnerability in Jenkins Mesos Plugin
osv·2022-05-13
CVE-2018-1000420 [MEDIUM] Improper authorization vulnerability in Jenkins Mesos Plugin
Improper authorization vulnerability in Jenkins Mesos Plugin
An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins.
GHSA
Improper authorization vulnerability in Jenkins Mesos Plugin
ghsa·2022-05-13
CVE-2018-1000420 [MEDIUM] CWE-863 Improper authorization vulnerability in Jenkins Mesos Plugin
Improper authorization vulnerability in Jenkins Mesos Plugin
An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins.
Jenkins
Jenkins Security Advisory 2018-09-25
vendor_jenkins·2018-09-25·CVSS 6.5
CVE-2017-12197 [MEDIUM] Jenkins Security Advisory 2018-09-25
Title: Jenkins Security Advisory 2018-09-25
Jenkins Security Advisory 2018-09-25
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Arachni Scanner
Plugin
Argus Notifier
Plugin
Artifactory
Plugin
Chatter Notifier
Plugin
Config File Provider
Plugin
crowd2
Plugin
Dimensions
Plugin
Email Extensio
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-01-09
Published