CVE-2019-10472: Medium severity jenkins libvirt agents vulnerability
A missing permission check in Jenkins Libvirt Slaves Plugin allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10472?
CVE-2019-10472 is classified as a medium-severity vulnerability due to its potential to expose sensitive SSH credentials.
How do I fix CVE-2019-10472?
To fix CVE-2019-10472, upgrade the Jenkins Libvirt Slaves Plugin to version 1.8.6 or later.
Who is affected by CVE-2019-10472?
Users of Jenkins with installed versions of the Libvirt Slaves Plugin up to 1.8.5 are affected by CVE-2019-10472.
What does CVE-2019-10472 exploit?
CVE-2019-10472 exploits a missing permission check allowing unauthorized SSH connections to specified servers.
What are the consequences of CVE-2019-10472?
The consequence of CVE-2019-10472 is the potential unauthorized access to sensitive credentials stored in Jenkins.