CVE-2019-10442: Medium severity jenkins icescrum vulnerability
Published Oct 16, 2019
·Updated
A missing permission check in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
Affected Software
1 affected component
Jenkins Icescrum Jenkins<=1.1.5
Event History
Oct 16, 2019
CVE Published
via MITRE·01:00 PM
Data Sourced
via MITRE·01:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-10442?
CVE-2019-10442 is considered a medium severity vulnerability due to the potential for unauthorized access to attacker-specified URLs.
2
How do I fix CVE-2019-10442?
To fix CVE-2019-10442, upgrade the Jenkins iceScrum Plugin to version 1.1.6 or later.
3
Who is affected by CVE-2019-10442?
All Jenkins installations using the iceScrum Plugin versions 1.1.5 and earlier are affected by CVE-2019-10442.
4
What type of vulnerability is CVE-2019-10442?
CVE-2019-10442 is a missing permission check vulnerability that allows attackers to exploit the plugin.
5
Can attackers exploit CVE-2019-10442 without authentication?
Attackers must have Overall/Read permission to exploit CVE-2019-10442, which limits the attack vector.