CVE-2019-10357: Missing Authorization in Jenkins Pipeline: Shared Groovy Libraries Plugin
Summary
CVE-2019-10357: Missing Authorization in Jenkins Pipeline: Shared Groovy Libraries Plugin. Affects org.jenkins-ci.plugins.workflow:workflow-cps-global-lib versions < 2.15. Fixed in 2.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Pipeline: Shared Groovy Libraries Plugin is a component of the Jenkins automation server that allows users to define and share reusable Groovy code libraries. These libraries can be referenced and used in Jenkins pipelines to simplify and streamline the development process. The plugin integrates with SCM repositories to fetch the library code. However, versions 2.14 and earlier of the plugin have a missing permission check, which allows users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries.
Vulnerability Detail
The missing authorization check in the Jenkins Pipeline: Shared Groovy Libraries Plugin exposes sensitive information about the content of SCM repositories. This vulnerability allows users with Overall/Read access to gain insights into the code and potentially exploit any weaknesses or vulnerabilities present in the libraries. While the impact is limited to information disclosure, it can still pose a risk if the SCM repositories contain sensitive or proprietary code. The vulnerability has a CVSS score of 4.3.
How To Fix
Minimum fixed version
2.15
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the Jenkins server by limiting Overall/Read permissions to trusted users only. This can be done through the Jenkins security settings. However, this workaround may not provide complete protection and upgrading to the fixed version is still recommended.
Conclusion
The Jenkins Pipeline: Shared Groovy Libraries Plugin versions 2.14 and earlier are affected by a vulnerability that allows unauthorized users to obtain limited information about SCM repositories. Upgrading to version 2.15 or later of the plugin is recommended to fix this vulnerability. Users can also apply a temporary workaround by restricting access to trusted users. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins.workflow:workflow-cps-global-lib →
FAQ
The Jenkins Pipeline: Shared Groovy Libraries Plugin is a component of the Jenkins automation server that allows users to define and share reusable Groovy code libraries.
The vulnerability allows users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries.
The CVSS score of this vulnerability is 4.3.
To fix this vulnerability, it is recommended to upgrade to version 2.15 or later of the Jenkins Pipeline: Shared Groovy Libraries Plugin.
As a temporary workaround, users can restrict access to the Jenkins server by limiting Overall/Read permissions to trusted users only.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins.workflow:workflow-cps-global-lib.
