~ / search / GHSA-57ww-2cvr-wv38

GHSA-57ww-2cvr-wv38

Jenkins Job Import Plugin vulnerable to exposure of sensitive information

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-1003016

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:job-import-plugin < 3.0 3.0

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Job Import Plugin did not check user permissions on its API endpoint used to access remote Jenkins instances. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Job Import Plugin 3.0 will only access Jenkins instances using credentials defined in the global configuration.

References

External links from the advisory. They lead to third-party sites.