Server-side request forgery vulnerability in Jenkins Mesos Plugin

2022-05-1401:38:17

Google

osv.dev

6.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

37.1%

JSON

An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to initiate a test connection to an attacker-specified Mesos server with attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

CPENameOperatorVersion
org.jenkins-ci.plugins:mesoseq0.4.0
org.jenkins-ci.plugins:mesoseq0.13.1
org.jenkins-ci.plugins:mesoseq0.17.1
org.jenkins-ci.plugins:mesoseq0.5.0
org.jenkins-ci.plugins:mesoseq0.6.0
org.jenkins-ci.plugins:mesoseq0.7.0
org.jenkins-ci.plugins:mesoseq0.2.0
org.jenkins-ci.plugins:mesoseq0.10.0-beta-1
org.jenkins-ci.plugins:mesoseq0.10.0-beta-4
org.jenkins-ci.plugins:mesoseq0.13.0

Name	Operator	Version
org.jenkins-ci.plugins:mesos	eq	0.4.0
org.jenkins-ci.plugins:mesos	eq	0.13.1
org.jenkins-ci.plugins:mesos	eq	0.17.1
org.jenkins-ci.plugins:mesos	eq	0.5.0
org.jenkins-ci.plugins:mesos	eq	0.6.0
org.jenkins-ci.plugins:mesos	eq	0.7.0
org.jenkins-ci.plugins:mesos	eq	0.2.0
org.jenkins-ci.plugins:mesos	eq	0.10.0-beta-1
org.jenkins-ci.plugins:mesos	eq	0.10.0-beta-4
org.jenkins-ci.plugins:mesos	eq	0.13.0