Temporary File Exposure in Jenkins Google Kubernetes Engine Plugin
CVE-2019-10365

4.3MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Google Kubernetes Engine Plugin
Vendor
CVE Published:
31 July 2019

Summary

The Jenkins Google Kubernetes Engine Plugin versions 0.6.2 and earlier are susceptible to a file exposure vulnerability. When the plugin operates, it creates a temporary file that contains a sensitive access token within the project workspace. This file can potentially be accessed by users who possess Job/Read permissions, leading to unauthorized access to sensitive information within the environment. Proper configuration and restrictions are necessary to mitigate this risk and secure the Jenkins instance.

Affected Version(s)

Jenkins Google Kubernetes Engine Plugin 0.6.2 and earlier

References

http://www.openwall.com/lists/oss-security/2019/07/31/1
mailing-listx_refsource_MLIST
https://jenkins.io/security/advisory/2019-07-31/#SECURITY...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.