Missing Permission Check in Jenkins WebSphere Deployer Plugin
CVE-2019-16559

5.4MEDIUM

Key Information:

Vendor: Jenkins
Status: Jenkins Websphere Deployer Plugin
Vendor: CVE Published:; 17 December 2019

What is CVE-2019-16559?

A flaw in the Jenkins WebSphere Deployer Plugin enables users with Overall/Read permission to execute connection tests. This vulnerability could allow an attacker to ascertain the existence of files specified by the attacker on the Jenkins master file system, posing a significant risk of unauthorized access to sensitive information.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Jenkins WebSphere Deployer Plugin <= 1.6.1

References

https://jenkins.io/security/advisory/2019-12-17/#SECURITY...

x_refsource_CONFIRM

http://www.openwall.com/lists/oss-security/2019/12/17/1

mailing-listx_refsource_MLIST

CVSS V3.1

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Dec 17, 2019
Vulnerability Reserved
Sep 20, 2019

JSON

Jenkins