CVE-2019-10339: High severity jenkins jx resources vulnerability
A missing permission check in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed users with Overall/Read access to have Jenkins connect to an attacker-specified Kubernetes server, potentially leaking credentials.
Other sources
Jenkins jx-resources Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified Kubernetes server and obtain information about an attacker-specified namespace. Doing so might also leak service account credentials used for the connection. Additionally, it allowed attackers to obtain the value of any attacker-specified environment variable for the Jenkins controller process.
Additionally, this form validation method did not require POST requests, resulting in a cross-site request forgery vulnerability.
This form validation method now requires POST requests and Overall/Administer permissions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10339?
CVE-2019-10339 is considered a medium severity vulnerability due to its potential for credential leakage.
How do I fix CVE-2019-10339?
To fix CVE-2019-10339, update the Jenkins JX Resources Plugin to version 1.0.37 or later.
Who is affected by CVE-2019-10339?
CVE-2019-10339 affects users of Jenkins JX Resources Plugin versions 1.0.36 and earlier.
What does CVE-2019-10339 allow an attacker to do?
CVE-2019-10339 allows an attacker to connect Jenkins to an attacker-specified Kubernetes server, which could result in credential leakage.
What Jenkins component is involved in CVE-2019-10339?
The vulnerability CVE-2019-10339 involves the Jenkins GlobalPluginConfiguration component in the JX Resources Plugin.