CVE-2019-10301

2019-04-1817:29:00

Google

osv.dev

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.3%

JSON

A missing permission check in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

CPENameOperatorVersion
gitlab-plugineqgitlab-plugin-1.0.8
gitlab-plugineqgitlab-plugin-1.1.13
gitlab-plugineqgitlab-plugin-1.1.16
gitlab-plugineqgitlab-plugin-1.0.10
gitlab-plugineqgitlab-plugin-1.1.3
gitlab-plugineqgitlab-plugin-1.5.3
gitlab-plugineqgitlab-plugin-1.5.7
gitlab-plugineqgitlab-plugin-1.2.3
gitlab-plugineqgitlab-plugin-1.1.21
gitlab-plugineqgitlab-plugin-1.4.1

Name	Operator	Version
gitlab-plugin	eq	gitlab-plugin-1.0.8
gitlab-plugin	eq	gitlab-plugin-1.1.13
gitlab-plugin	eq	gitlab-plugin-1.1.16
gitlab-plugin	eq	gitlab-plugin-1.0.10
gitlab-plugin	eq	gitlab-plugin-1.1.3
gitlab-plugin	eq	gitlab-plugin-1.5.3
gitlab-plugin	eq	gitlab-plugin-1.5.7
gitlab-plugin	eq	gitlab-plugin-1.2.3
gitlab-plugin	eq	gitlab-plugin-1.1.21
gitlab-plugin	eq	gitlab-plugin-1.4.1