GHSA-57ww-2cvr-wv38

Source

https://github.com/advisories/GHSA-57ww-2cvr-wv38

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-57ww-2cvr-wv38/GHSA-57ww-2cvr-wv38.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-57ww-2cvr-wv38

Aliases

CVE-2019-1003016

Published

2022-05-13T01:31:34Z

Modified

2024-02-16T08:13:05Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Jenkins Job Import Plugin vulnerable to exposure of sensitive information

Details

Jenkins Job Import Plugin did not check user permissions on its API endpoint used to access remote Jenkins instances. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Job Import Plugin 3.0 will only access Jenkins instances using credentials defined in the global configuration.

Database specific

{
    "cwe_ids":  [
        "CWE-352"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-10-25T23:04:27Z",
    "nvd_published_at":  "2019-02-06T16:29:00Z",
    "severity":  "MODERATE"
}

References

Affected packages

Maven / org.jenkins-ci.plugins:job-import-plugin

Package

Name: org.jenkins-ci.plugins:job-import-plugin; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/job-import-plugin

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.0

Affected versions

1.*

1.0

1.1

1.2

1.3

1.3.1

1.5

1.6

1.7

1.8

2.*

2.0

2.1

Database specific

last_known_affected_version_range

"<= 2.1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-57ww-2cvr-wv38/GHSA-57ww-2cvr-wv38.json"