Sensitive Information Exposure in Jenkins Job Import Plugin

CVE-2019-1003016

Summary

The Jenkins Job Import Plugin prior to version 2.1 contains a vulnerability that enables an attacker with Overall/Read permissions to connect Jenkins to a maliciously crafted URL. This is achieved by leveraging attacker-specified credential IDs, which could be obtained through various means. Such an exploit could lead to the unintended disclosure of sensitive credentials stored within Jenkins, posing significant security risks to affected installations.

References