CVE-2019-10322

Опубликовано: 31 мая 2019

Источник: nvd

CVSS3: 4.3

CVSS2: 4

EPSS Низкий

Описание

A missing permission check in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Ссылки

http://www.openwall.com/lists/oss-security/2019/05/31/2
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/108540
Third Party Advisory
VDB Entry
https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1015%20%281%29
https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0787
Exploit
Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/05/31/2
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/108540
Third Party Advisory
VDB Entry
https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1015%20%281%29
https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0787
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:jenkins:*:*

Версия до 3.2.2 (включая)

EPSS

Процентиль: 50%

0.00264

Низкий

4.3 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-862

Связанные уязвимости

GHSA-gxm5-jrrf-5c4v

CVSS3: 6.5

github

больше 3 лет назад

Jenkins Artifactory Plugin missing permission check