CVE-2019-16575

2019-12-1715:15:24

Google

osv.dev

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

33.2%

JSON

A cross-site request forgery vulnerability in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing the Kubernetes service account token or credentials stored in Jenkins.

CPENameOperatorVersion
alauda-kubernetes-support-plugineqalauda-kubernetes-support-2.2.0
alauda-kubernetes-support-plugineqalauda-kubernetes-support-2.3.0
alauda-kubernetes-support-plugineqalauda-kubernetes-support-2.1.2
alauda-kubernetes-support-plugineqalauda-kubernetes-support-2.1.1
alauda-kubernetes-support-plugineqalauda-kubernetes-support-2.0.0
alauda-kubernetes-support-plugineqalauda-kubernetes-support-2.1.0-alpha

Name	Operator	Version
alauda-kubernetes-support-plugin	eq	alauda-kubernetes-support-2.2.0
alauda-kubernetes-support-plugin	eq	alauda-kubernetes-support-2.3.0
alauda-kubernetes-support-plugin	eq	alauda-kubernetes-support-2.1.2
alauda-kubernetes-support-plugin	eq	alauda-kubernetes-support-2.1.1
alauda-kubernetes-support-plugin	eq	alauda-kubernetes-support-2.0.0
alauda-kubernetes-support-plugin	eq	alauda-kubernetes-support-2.1.0-alpha