GHSA-7jf5-p556-75prMediumCVSS 6.5

Jenkins Kubernetes CI/CD Plugin vulnerable to Credential Enumeration

Published
May 24, 2022
Last Modified
November 4, 2023

🔗 CVE IDs covered (1)

CVE-2019-10470 →

📋 Description

A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.

Note: Jenkins has suspended distribution of this plugin.

🎯 Affected products1

  • maven/com.elasticbox.jenkins-ci.plugins:kubernetes-ci:<= 1.3

🔗 References (5)