CVE-2019-1003016: Jenkins project Jenkins Job Import Plugin

Описание

Оригинално описание

An exposure of sensitive information vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/JobImportAction.java, src/main/java/org/jenkins/ci/plugins/jobimport/JobImportGlobalConfig.java, src/main/java/org/jenkins/ci/plugins/jobimport/model/JenkinsSite.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Засегнати продукти

• Jenkins project Jenkins Job Import Plugin: 2.1 and earlier

История

Други уязвимости в Jenkins project Jenkins Job Import Plugin

• 4.3CVE-2026-48926
• 4.3CVE-2022-43413
• CVE-2019-1003017
• CVE-2019-1003015

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2019-1003016
• https://nvd.nist.gov/vuln/detail/CVE-2019-1003016
• https://jenkins.io/security/advisory/2019-01-28/#SECURITY-905%20%282%29