CVE-2019-10339

2019-06-1114:29:01

Google

osv.dev

6.6 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

66.2%

JSON

A missing permission check in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed users with Overall/Read access to have Jenkins connect to an attacker-specified Kubernetes server, potentially leaking credentials.

CPENameOperatorVersion
jx-resources-plugineq1.0.14
jx-resources-plugineq1.0.12
jx-resources-plugineq1.0.23
jx-resources-plugineq1.0.11
jx-resources-plugineq1.0.30
jx-resources-plugineq1.0.4
jx-resources-plugineq1.0.31
jx-resources-plugineq1.0.1
jx-resources-plugineq1.0.24
jx-resources-plugineq1.0.5

Name	Operator	Version
jx-resources-plugin	eq	1.0.14
jx-resources-plugin	eq	1.0.12
jx-resources-plugin	eq	1.0.23
jx-resources-plugin	eq	1.0.11
jx-resources-plugin	eq	1.0.30
jx-resources-plugin	eq	1.0.4
jx-resources-plugin	eq	1.0.31
jx-resources-plugin	eq	1.0.1
jx-resources-plugin	eq	1.0.24
jx-resources-plugin	eq	1.0.5