Jenkins JIRA Plugin Vulnerability in Version 3.0.10 and Earlier
CVE-2019-16541

9.9CRITICAL

Key Information:

Vendor
Jenkins
Status
Jenkins Jira Plugin
Vendor
CVE Published:
21 November 2019

Summary

The Jenkins JIRA Plugin prior to version 3.0.11 fails to set the appropriate scope for per-folder JIRA site definitions. This flaw allows users to select credentials that have System scope instead of the intended folder scope, potentially leading to unauthorized access to sensitive information and administrative privileges. This vulnerability poses a risk to Jenkins installations utilizing the JIRA Plugin, as it undermines the principle of least privilege.

Affected Version(s)

Jenkins JIRA Plugin 3.0.10 and earlier

References

https://jenkins.io/security/advisory/2019-11-21/#SECURITY...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2019/11/21/1
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.