CVE-2019-10338: CSRF
A cross-site request forgery vulnerability in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed attackers to have Jenkins connect to an attacker-specified Kubernetes server, potentially leaking credentials.
Other sources
Jenkins jx-resources Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified Kubernetes server and obtain information about an attacker-specified namespace. Doing so might also leak service account credentials used for the connection. Additionally, it allowed attackers to obtain the value of any attacker-specified environment variable for the Jenkins controller process.
Additionally, this form validation method did not require POST requests, resulting in a cross-site request forgery vulnerability.
This form validation method now requires POST requests and Overall/Administer permissions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10338?
CVE-2019-10338 is classified as a medium severity vulnerability due to its potential for credential leakage.
How do I fix CVE-2019-10338?
To fix CVE-2019-10338, update the Jenkins JX Resources Plugin to version 1.0.37 or later.
What software is affected by CVE-2019-10338?
CVE-2019-10338 affects Jenkins JX Resources Plugin versions 1.0.36 and earlier.
What type of vulnerability is CVE-2019-10338?
CVE-2019-10338 is a cross-site request forgery (CSRF) vulnerability.
What risks are associated with CVE-2019-10338?
The risks associated with CVE-2019-10338 include unauthorized connections to attacker-specified Kubernetes servers, which could lead to credential exposure.