Improper Authorization in Jenkins Mesos Plugin by CloudBees
CVE-2018-1000421

6.5MEDIUM

Key Information:

Vendor

Apache
Status
Mesos
Vendor
CVE Published:
9 January 2019

What is CVE-2018-1000421?

The Jenkins Mesos Plugin suffers from an improper authorization vulnerability that permits attackers with Overall/Read access to initiate test connections to malicious Mesos servers. By leveraging this vulnerability, attackers can input arbitrary credentials IDs, potentially exposing sensitive information stored within the Jenkins environment. This issue underscores the importance of strict access controls and authentication measures to protect against unauthorized access and credential leakage.

References

http://www.securityfocus.com/bid/106532
vdb-entryx_refsource_BID
https://jenkins.io/security/advisory/2018-09-25/#SECURITY...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2018-1000421 : Improper Authorization in Jenkins Mesos Plugin by CloudBees