Missing Authorization in Jenkins Kubernetes CLI Plugin

2021-06-1617:11:30

Google

osv.dev

4.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.2%

JSON

Jenkins Kubernetes CLI Plugin 1.10.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

CPENameOperatorVersion
org.jenkins-ci.plugins:kubernetes-clieq1.6.0
org.jenkins-ci.plugins:kubernetes-clieq1.1.0
org.jenkins-ci.plugins:kubernetes-clieq1.8.1
org.jenkins-ci.plugins:kubernetes-clieq1.8.0
org.jenkins-ci.plugins:kubernetes-clieq1.8.2
org.jenkins-ci.plugins:kubernetes-clieq1.4.0
org.jenkins-ci.plugins:kubernetes-clieq1.0.0
org.jenkins-ci.plugins:kubernetes-clieq1.5.0
org.jenkins-ci.plugins:kubernetes-clieq1.7.0
org.jenkins-ci.plugins:kubernetes-clieq0.1.0

Name	Operator	Version
org.jenkins-ci.plugins:kubernetes-cli	eq	1.6.0
org.jenkins-ci.plugins:kubernetes-cli	eq	1.1.0
org.jenkins-ci.plugins:kubernetes-cli	eq	1.8.1
org.jenkins-ci.plugins:kubernetes-cli	eq	1.8.0
org.jenkins-ci.plugins:kubernetes-cli	eq	1.8.2
org.jenkins-ci.plugins:kubernetes-cli	eq	1.4.0
org.jenkins-ci.plugins:kubernetes-cli	eq	1.0.0
org.jenkins-ci.plugins:kubernetes-cli	eq	1.5.0
org.jenkins-ci.plugins:kubernetes-cli	eq	1.7.0
org.jenkins-ci.plugins:kubernetes-cli	eq	0.1.0