Description

A missing permission check in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed users with Overall/Read access to have Jenkins connect to an attacker-specified Kubernetes server, potentially leaking credentials.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/06/11/1

http://www.securityfocus.com/bid/108747

https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1379

Related Vulnerabilities

CVE-2023-38435 Vulnerability in maven package org.apache.felix:org.apache.felix.healthcheck.webconsoleplugin

CVE-2019-11002 Vulnerability in maven package org.webjars.npm:materialize-css

CVE-2020-28271 Vulnerability in npm package deephas

CVE-2022-25852 Vulnerability in npm package pg-native

CVE-2020-7690 Vulnerability in maven package org.webjars:jspdf

Severity

Critical

Classification

CWE-862 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory VDB Entry Vendor Advisory