CVE-2019-10439 — Missing Authorization in Jenkins CRX Content Package Deployer

CWE-862 — Missing Authorization CWE-285 — Improper Authorization5 documents5 sources

Severity

4.3MEDIUMNVD

EPSS

0.0%

top 91.11%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Jenkins CRX Content Package Deployer Jenkins Project Jenkins CRX Content Package Deployer Plugin

Timeline

PublishedOct 16

Latest updateMay 24

Description

A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier in various 'doFillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5jenkins_project/jenkins_crx_content_package_deployer_plugin1.8.1 and earlier

▶NVDjenkins/crx_content_package_deployer1.8.1

🔴Vulnerability Details

OSV

Jenkins CRX Content Package Deployer Plugin subject to credentials enumeration via Missing Authorization↗2022-05-24

▶

GHSA

Jenkins CRX Content Package Deployer Plugin subject to credentials enumeration via Missing Authorization↗2022-05-24

▶

CVEList

CVE-2019-10439: A missing permission check in Jenkins CRX Content Package Deployer Plugin 1↗2019-10-16

▶

📋Vendor Advisories

Jenkins

Jenkins Security Advisory 2019-10-16↗2019-10-16

▶