CVE-2019-10320

CVE-2019-10320: falha em Jenkins Credentials Plugin

Publicada em 21 mai 2019 · Atualizada em 04 ago 2024

Seguir esta CVE + Monitorar Jenkins Credentials Plugin + Monitorar org.jenkins-ci.plugins:credentials

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 1.0%

Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.

Produtos afetados

Jenkins project · Jenkins Credentials Plugin

CVEs relacionadas — Jenkins Credentials Plugin

No mesmo produto, das mais perigosas para as menos.

CVE-2022-29036—CVE-2022-29036EPSS 71.9%CVE-2021-21648—CVE-2021-21648EPSS 11.3%

Referências

https://access.redhat.com/errata/RHBA-2019:1605 https://access.redhat.com/errata/RHSA-2019:1636 http://seclists.org/fulldisclosure/2019/May/39 https://jenkins.io/security/advisory/2019-05-21/#SECURITY-1322 https://wwws.nightwatchcybersecurity.com/2019/05/23/exploring-the-file-system-via-jenkins-credentials-plugin-vulnerability-cve-2019-10320/http://www.openwall.com/lists/oss-security/2019/05/21/1 http://www.securityfocus.com/bid/108462