CVE-2019-10301: High severity jenkins gitlab vulnerability
A missing permission check in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Other sources
Jenkins GitLab Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Additionally, this form validation method did not require POST requests, resulting in a cross-site request forgery vulnerability.
This form validation method now requires POST requests and Overall/Administer permissions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10301?
CVE-2019-10301 is categorized as a medium severity vulnerability.
How do I fix CVE-2019-10301?
To fix CVE-2019-10301, upgrade Jenkins GitLab Plugin to version 1.5.12 or later.
What causes the vulnerability CVE-2019-10301?
CVE-2019-10301 is caused by a missing permission check in the form validation method of the Jenkins GitLab Plugin.
Who is affected by CVE-2019-10301?
CVE-2019-10301 affects users of Jenkins GitLab Plugin version 1.5.11 and earlier.
What types of attacks can exploit CVE-2019-10301?
CVE-2019-10301 can be exploited by attackers to connect to arbitrary URLs using compromised credentials.