CVE-2019-10320

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 1.0%

probabilidade de exploração

1.0%top 40% das CVEs

exploração observada

nãonenhuma fonte reporta

Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.

Produtos afetados

Jenkins project · Jenkins Credentials Plugin

Referências

https://access.redhat.com/errata/RHBA-2019:1605 https://access.redhat.com/errata/RHSA-2019:1636 http://seclists.org/fulldisclosure/2019/May/39 https://jenkins.io/security/advisory/2019-05-21/#SECURITY-1322 https://wwws.nightwatchcybersecurity.com/2019/05/23/exploring-the-file-system-via-jenkins-credentials-plugin-vulnerability-cve-2019-10320/http://www.openwall.com/lists/oss-security/2019/05/21/1 http://www.securityfocus.com/bid/108462