Jenkins Docker vulnerabilities

3 known vulnerabilities affecting jenkins/docker.

Total CVEs

3

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

HIGH1MEDIUM2

Vulnerabilities

Page 1 of 1

CVE-2019-10340HIGHCVSS 8.8≤ 1.1.62019-07-11

CVE-2019-10340 [HIGH] CWE-352 CVE-2019-10340: A cross-site request forgery vulnerability in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.D A cross-site request forgery vulnerability in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

CVE-2019-10342MEDIUMCVSS 4.3≤ 1.1.62019-07-11

CVE-2019-10342 [MEDIUM] CWE-862 CVE-2019-10342: A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in various 'fillCredentialsIdI A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.

CVE-2019-10341MEDIUMCVSS 6.5≤ 1.1.62019-07-11

CVE-2019-10341 [MEDIUM] CWE-862 CVE-2019-10341: A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#do A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.