CVE-2019-10438: Jenkins CRX Content Package Deployer Plugin Missing Authorization
Summary
CVE-2019-10438: Jenkins CRX Content Package Deployer Plugin subject to Missing Authorization. Affects org.jenkins-ci.plugins:crx-content-package-deployer versions < 1.9. Fixed in 1.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins CRX Content Package Deployer Plugin is a Maven-based plugin that allows users to deploy content packages to Adobe CRX repositories. It provides functionality for managing and deploying content packages in Jenkins CI/CD pipelines. The plugin is widely used in Jenkins environments for automating the deployment of content packages to Adobe CRX repositories.
Vulnerability Detail
The Jenkins CRX Content Package Deployer Plugin prior to version 1.9 is vulnerable to a Missing Authorization issue. Attackers with Overall/Read permission can exploit this vulnerability to connect to a specified URL using attacker-specified credentials IDs obtained through another method. This allows them to capture credentials stored in Jenkins. The vulnerability is rated as moderate with a CVSS score of 6.5. The issue is patched in version 1.9 of the plugin.
How To Fix
Minimum fixed version
1.9
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the patch by upgrading to version 1.9 or later.
Conclusion
The Jenkins CRX Content Package Deployer Plugin prior to version 1.9 is vulnerable to a Missing Authorization issue that allows attackers to capture credentials stored in Jenkins. To mitigate this vulnerability, it is crucial to upgrade the plugin to version 1.9 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:crx-content-package-deployer →
FAQ
The vulnerability allows attackers with Overall/Read permission to capture credentials stored in Jenkins, potentially leading to unauthorized access to sensitive information or systems.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
There are no known public exploits for this vulnerability at the time of this report. However, it is crucial to apply the patch as soon as possible to mitigate the risk of exploitation.
No, upgrading to version 1.9 or later is the recommended solution to fix this vulnerability. There are no known workarounds or alternative mitigation methods.
You can find more information about the Jenkins CRX Content Package Deployer Plugin on the official Jenkins website or the plugin's GitHub repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:crx-content-package-deployer.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
