CVE-2019-10472

CVSS v3.1 6.5 (Medium)

CVSS v2.0 4 (Medium)

EPSS 0.06 % (28^th)

Affected Products 1

Advisories 2

A missing permission check in Jenkins Libvirt Slaves Plugin allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Weaknesses

CWE-276: Incorrect Default Permissions

CVE Status: PUBLISHED
CNA: Jenkins Project
Published Date: 2019-10-23 13:15:11
(4 years ago)
Updated Date: 2023-10-25 18:16:25
(10 months ago)

Affected Products

Jenkins

Libvirt Slaves

Configuration #1

		CPE23	From	Up To
	Jenkins Libvirt Slaves for Jenkins 1.8.5 and prior versions	cpe:2.3:a:jenkins:libvirt_slaves::::::jenkins		<= 1.8.5