CVE-2019-10320

EPSS 0.12%
Published 21.05.2019 13:29:00
Last modified 21.11.2024 04:18:53
Source jenkinsci-cert@googlegroups.co
Teams watchlist Login
Open Login

Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.

Affected products Warnungen 0 Metrics 3 CWE 1 References 10

Data is provided by the National Vulnerability Database (NVD)

Jenkins ≫ Credentials SwPlatformjenkins Version <= 2.1.18

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.12%	0.275

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	4.3	2.8	1.4	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvd@nist.gov	4	8	2.9	AV:N/AC:L/Au:S/C:P/I:N/A:N

CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory

The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

https://access.redhat.com/errata/RHBA-2019:1605

http://www.openwall.com/lists/oss-security/2019/05/21/1

http://seclists.org/fulldisclosure/2019/May/39

http://www.securityfocus.com/bid/108462

https://access.redhat.com/errata/RHSA-2019:1636

https://jenkins.io/security/advisory/2019-05-21/#SECURITY-1322

Vendor Advisory

Mitigation

https://wwws.nightwatchcybersecurity.com/2019/05/23/exploring-the-file-system-via-jenkins-credentials-plugin-vulnerability-cve-2019-10320/

https://nvd.nist.gov/vuln/detail/CVE-2019-10320

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-10320

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-10320

EUVD