CVE-2019-10320

4.3MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Credentials Plugin
Vendor
CVE Published:
21 May 2019

Summary

Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.

Affected Version(s)

Jenkins Credentials Plugin 2.1.18 and earlier

References

http://www.openwall.com/lists/oss-security/2019/05/21/1
mailing-listx_refsource_MLIST
http://seclists.org/fulldisclosure/2019/May/39
mailing-listx_refsource_FULLDISC
http://www.securityfocus.com/bid/108462
vdb-entryx_refsource_BID

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.