GHSA-hch9-6qrj-5f49MediumCVSS 6.5

Jenkins Kubernetes CI/CD Plugin vulnerable to Improper Authorization

Published
May 24, 2022
Last Modified
October 26, 2023

🔗 CVE IDs covered (1)

CVE-2019-10469 →

📋 Description

A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Note: Jenkins has suspended distribution of this plugin.

🎯 Affected products1

  • maven/com.elasticbox.jenkins-ci.plugins:kubernetes-ci:<= 1.3

🔗 References (5)