CVE-2019-10320: Infoleak
Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.
Other sources
The Jenkins Credentials Plugin allowed the creation of Certificate credentials from a PKCS#12 file on the Jenkins master. Users with permission to create or update credentials could use the associated form validation to confirm the existence of files with an attacker-specified path.
Additionally, they could create credentials from any valid PKCS#12 file on the Jenkins master. With the ability to configure jobs to access these credentials, they could obtain the certificate content.
External References:
https://jenkins.io/security/advisory/2019-05-21/#SECURITY-1322
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-10320?
The severity of CVE-2019-10320 is categorized as high due to its potential to expose sensitive certificate information.
How do I fix CVE-2019-10320?
To fix CVE-2019-10320, upgrade the Jenkins Credentials Plugin to version 2.1.19 or later.
Who is affected by CVE-2019-10320?
CVE-2019-10320 affects users of Jenkins Credentials Plugin version 2.1.18 and earlier.
What type of vulnerability is CVE-2019-10320?
CVE-2019-10320 is a file disclosure vulnerability that allows confirmation of file existence and extraction of certificate content.
What is the consequence of CVE-2019-10320?
The consequence of CVE-2019-10320 includes the potential for unauthorized users to access sensitive PKCS#12 certificate files.