CVE-2019-16539

published 2019-11-21

CVE-2019-16539: A missing permission check in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete support bundles.

Priority P4 33 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C N I H A N

A missing permission check in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete support bundles.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
jenkins	anchore_container_image_scanner_plugin	—	—
jenkins	folder-scoped_jira_sites_in_jira_plugin	—	—
jenkins	google_compute_engine_plugin	—	—
jenkins	jira_plugin	—	—
jenkins	qmetry_for_jira_test_management_plugin	—	—
jenkins	sandbox_protection_in_script_security_plugin	—	—
jenkins	script_security_plugin	—	—
jenkins	spira_importer_plugin	—	—
jenkins	support_core	<= 2.63	—
jenkins	support_core_plugin	—	—
jenkins	vms_launched_by_the_plugin	—	—
jenkins_project	jenkins_support_core_plugin	—	—

CVSS provenance

nvd v3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

nvd v2.0 5.5 MEDIUM AV:N/AC:L/Au:S/C:N/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-281