CVE-2019-10470: Medium severity jenkins kubernetes ci vulnerability
Published Oct 23, 2019
·Updated
A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
Affected Software
2 affected components
maven/com.elasticbox.jenkins-ci.plugins:kubernetes-ci<=1.3
Jenkins Kubernetes Ci Jenkins<=1.3
Event History
Oct 23, 2019
CVE Published
via MITRE·12:45 PM
Data Sourced
via MITRE·12:45 PM
Description
May 24, 2022
Advisory Published
04:59 PM
Frequently Asked Questions
1
What is the severity of CVE-2019-10470?
CVE-2019-10470 is classified as a medium-severity vulnerability.
2
How do I fix CVE-2019-10470?
To fix CVE-2019-10470, upgrade the Jenkins Kubernetes CI/CD Plugin to version 1.4 or later.
3
Who is affected by CVE-2019-10470?
Jenkins users utilizing the ElasticBox Kubernetes CI/CD Plugin version 1.3 or earlier are affected by CVE-2019-10470.
4
What does CVE-2019-10470 allow attackers to do?
CVE-2019-10470 allows users with Overall/Read access to enumerate credential IDs stored in Jenkins.
5
Is CVE-2019-10470 a remote code execution vulnerability?
No, CVE-2019-10470 does not involve remote code execution but rather a permissions issue.