CVE-2019-10469: Medium severity jenkins kubernetes ci vulnerability
Published Oct 23, 2019
·Updated
A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected Software
2 affected components
maven/com.elasticbox.jenkins-ci.plugins:kubernetes-ci<=1.3
Jenkins Kubernetes Ci Jenkins<=1.3
Event History
Oct 23, 2019
CVE Published
via MITRE·12:45 PM
Data Sourced
via MITRE·12:45 PM
Description
May 24, 2022
Advisory Published
04:59 PM
Frequently Asked Questions
1
What is the severity of CVE-2019-10469?
CVE-2019-10469 has a CVSS score indicating it is a medium severity vulnerability.
2
How do I fix CVE-2019-10469?
To fix CVE-2019-10469, users should update the Jenkins Kubernetes CI/CD Plugin to version 1.4 or later.
3
Who is affected by CVE-2019-10469?
CVE-2019-10469 affects Jenkins installations using the Kubernetes CI/CD Plugin version 1.3 or earlier.
4
What kind of attack is possible with CVE-2019-10469?
CVE-2019-10469 allows attackers to connect to arbitrary URLs and capture credentials stored in Jenkins.
5
What permissions are required to exploit CVE-2019-10469?
An attacker needs Overall/Read permission in Jenkins to exploit CVE-2019-10469.