CVE-2019-16566

CVSS v3.1 6.5 (Medium)

CVSS v2.0 4 (Medium)

EPSS 0.06 % (28^th)

Affected Products 1

Advisories 1

A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Weaknesses

CWE-862: Missing Authorization

CVE Status: PUBLISHED
CNA: Jenkins Project
Published Date: 2019-12-17 15:15:20
(4 years ago)
Updated Date: 2023-10-25 18:16:27
(10 months ago)

Affected Products

Jenkins

Team Concert

Configuration #1

		CPE23	From	Up To
	Jenkins Team Concert for Jenkins 1.3.0 and prior versions	cpe:2.3:a:jenkins:team_concert::::::jenkins		<= 1.3.0