CVE-2019-10305

2019-04-1817:29:00

Google

osv.dev

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.8%

JSON

A missing permission check in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.

CPENameOperatorVersion
xldeploy-plugineqdeployit-plugin-5.0.1
xldeploy-plugineqxldeploy-plugin-5.0.0
xldeploy-plugineqxldeploy-plugin-7.5.2
xldeploy-plugineqxldeploy-plugin-6.1.1
xldeploy-plugineqdeployit-plugin-3.9.6
xldeploy-plugineqxldeploy-plugin-7.5.0
xldeploy-plugineqxldeploy-plugin-7.5.3
xldeploy-plugineqxldeploy-plugin-7.5.1
xldeploy-plugineqxldeploy-plugin-4.5.0
xldeploy-plugineqxldeploy-plugin-6.0.0

Name	Operator	Version
xldeploy-plugin	eq	deployit-plugin-5.0.1
xldeploy-plugin	eq	xldeploy-plugin-5.0.0
xldeploy-plugin	eq	xldeploy-plugin-7.5.2
xldeploy-plugin	eq	xldeploy-plugin-6.1.1
xldeploy-plugin	eq	deployit-plugin-3.9.6
xldeploy-plugin	eq	xldeploy-plugin-7.5.0
xldeploy-plugin	eq	xldeploy-plugin-7.5.3
xldeploy-plugin	eq	xldeploy-plugin-7.5.1
xldeploy-plugin	eq	xldeploy-plugin-4.5.0
xldeploy-plugin	eq	xldeploy-plugin-6.0.0