Cross-Site Request Forgery in Jenkins ElasticBox Plugin
CVE-2019-10468

8.8HIGH

Key Information:

Vendor
Jenkins
Status
Jenkins Elasticbox Jenkins Kubernetes Ci/cd Plugin
Vendor
CVE Published:
23 October 2019

Summary

A Cross-Site Request Forgery vulnerability exists in the ElasticBox Jenkins Kubernetes CI/CD Plugin that allows malicious actors to connect to attacker-defined URLs using credentials they specify. This can lead to the exposure of sensitive information, as the attacker's unauthorized requests can capture credentials stored in Jenkins. Users should ensure they are applying proper security measures to mitigate this issue.

Affected Version(s)

Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier

References

https://jenkins.io/security/advisory/2019-10-23/#SECURITY...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2019/10/23/2
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.