CVE-2018-1000420

Опубликовано: 09 янв. 2019

Источник: nvd

CVSS3: 6.5

CVSS2: 4

EPSS Низкий

Описание

An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins.

Ссылки

http://www.securityfocus.com/bid/106532
Third Party Advisory
VDB Entry
https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1013%20%281%29
http://www.securityfocus.com/bid/106532
Third Party Advisory
VDB Entry
https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1013%20%281%29

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:apache:mesos:*:*:*:*:*:jenkins:*:*

Версия до 0.17.1 (включая)

EPSS

Процентиль: 45%

0.00221

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-863

Связанные уязвимости

GHSA-23xr-9xxr-vg3c