CVE-2019-10321

2019-05-3115:29:00

Google

osv.dev

6.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.1%

JSON

A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

CPENameOperatorVersion
jenkins-artifactory-plugineqartifactory-2.13.1
jenkins-artifactory-plugineqartifactory-2.16.2
jenkins-artifactory-plugineqartifactory-2.9.0
jenkins-artifactory-plugineqartifactory-2.2.4
jenkins-artifactory-plugineqartifactory-2.7.2
jenkins-artifactory-plugineqartifactory-2.0.6
jenkins-artifactory-plugineqartifactory-2.0.5
jenkins-artifactory-plugineqartifactory-2.0.0
jenkins-artifactory-plugineqartifactory-2.12.1
jenkins-artifactory-plugineqartifactory-2.13.0

Name	Operator	Version
jenkins-artifactory-plugin	eq	artifactory-2.13.1
jenkins-artifactory-plugin	eq	artifactory-2.16.2
jenkins-artifactory-plugin	eq	artifactory-2.9.0
jenkins-artifactory-plugin	eq	artifactory-2.2.4
jenkins-artifactory-plugin	eq	artifactory-2.7.2
jenkins-artifactory-plugin	eq	artifactory-2.0.6
jenkins-artifactory-plugin	eq	artifactory-2.0.5
jenkins-artifactory-plugin	eq	artifactory-2.0.0
jenkins-artifactory-plugin	eq	artifactory-2.12.1
jenkins-artifactory-plugin	eq	artifactory-2.13.0