Missing permission check in Jenkins Docker Plugin
Summary
CVE-2019-10341: Missing permission check in Jenkins Docker Plugin. Affects io.jenkins.docker:docker-plugin versions < 1.1.7. Fixed in 1.1.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Docker Plugin is a Maven package that allows users to integrate Docker containers into their Jenkins workflows. It provides functionality for managing Docker images, containers, and registries within Jenkins. The plugin is widely used in CI/CD pipelines to facilitate containerization and deployment processes.
Vulnerability Detail
The vulnerability identified in the Jenkins Docker Plugin (version 1.1.6 and earlier) is a missing permission check in the DockerAPI.DescriptorImpl#doTestConnection function. This flaw allows users with Overall/Read access to connect to a URL specified by an attacker using credentials obtained through another method. By exploiting this vulnerability, an attacker can capture credentials stored in Jenkins, potentially leading to unauthorized access and data breaches.
How To Fix
Minimum fixed version
1.1.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. Upgrading to the patched version is the recommended solution.
Conclusion
The missing permission check vulnerability in the Jenkins Docker Plugin can potentially lead to unauthorized access and data breaches. Users are advised to upgrade to version 1.1.7 or later to mitigate this vulnerability. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.jenkins.docker:docker-plugin →
FAQ
This vulnerability allows attackers to connect to arbitrary URLs using stolen credentials, potentially leading to unauthorized access and data breaches.
Users of Jenkins Docker Plugin versions 1.1.6 and earlier are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report.
Yes, this vulnerability can be exploited remotely by attackers with Overall/Read access to Jenkins.
Yes, the CVSS score for this vulnerability is 6.5 (Medium).
References
Related vulnerabilities
Recent vulnerabilities recorded for io.jenkins.docker:docker-plugin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
