CVE-2019-10342: Missing permission check in Jenkins Docker Plugin
Summary
CVE-2019-10342: Missing permission check in Jenkins Docker Plugin. Affects io.jenkins.docker:docker-plugin versions < 1.1.7. Fixed in 1.1.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Docker Plugin is a Maven package (io.jenkins.docker:docker-plugin) that allows users to integrate Docker containers into their Jenkins workflows. It provides functionality for managing Docker images, containers, and registries within Jenkins. This vulnerability affects versions 1.1.6 and earlier of the plugin.
Vulnerability Detail
The vulnerability (CVE-2019-10342) in the Jenkins Docker Plugin arises from a missing permission check in various 'fillCredentialsIdItems' methods. This flaw allows users with Overall/Read access to enumerate the credentials ID of credentials stored in Jenkins. Attackers with this level of access can gather sensitive information about the credentials used in the Jenkins environment, potentially leading to further exploitation or unauthorized access.
How To Fix
Minimum fixed version
1.1.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the latest version of the Jenkins Docker Plugin.
Conclusion
The missing permission check vulnerability in the Jenkins Docker Plugin (CVE-2019-10342) allows users with Overall/Read access to enumerate credentials IDs, potentially leading to unauthorized access or further exploitation. Users should upgrade to version 1.1.7 or later of the plugin to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for io.jenkins.docker:docker-plugin →
FAQ
The vulnerability allows users with Overall/Read access to enumerate credentials IDs in Jenkins, potentially exposing sensitive information and leading to further exploitation.
Users of Jenkins Docker Plugin versions 1.1.6 and earlier are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this report.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins environment is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time.
You can find more information about the Jenkins Docker Plugin on the official Jenkins website or the plugin's GitHub repository.
Related vulnerabilities
Recent vulnerabilities recorded for io.jenkins.docker:docker-plugin.
