CVE-2019-10320

Aliases:GHSA-xm94-9jw8-p6hw
Advisory lineage Upstream: 0 Downstream: 2
Modified
Published: 21 May 2019, 13:00
Last modified:04 Aug 2024, 22:17

Vulnerability Summary

Overall Risk (default)
low
17/100
CVSS Score
4.3 MEDIUM
v3.0 (nvd)
EPSS Score
0.06% LOW
0% probability -0.06%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

21 May 2019, 13:00
Published
Vulnerability first disclosed
04 Aug 2024, 22:17
Last Modified
Vulnerability information updated

Description

Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.

CVSS Metrics

  • v3.0•MEDIUM•Score: 4.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
  • v2.0•MEDIUM•Score: 4AV:N/AC:L/Au:S/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 0.06%• Percentile: 19%

Techniques & Countermeasures

  • CWE-538•Insertion of Sensitive Information into Externally-Accessible File or Directory

    The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

Affected Systems

  • jenkins project•jenkins credentials plugin

    2.1.18 and earlier

  • jenkins•credentials

    ≤ 2.1.18

  • org.jenkins-ci.plugins•credentials

    < 2.1.19

References (10)