CVE-2019-10445: Missing permission checks in Google Kubernetes Engine Jenkins Plugin
Summary
CVE-2019-10445: Missing permission checks in Google Kubernetes Engine Jenkins Plugin. Affects org.jenkins-ci.plugins:google-kubernetes-engine versions < 0.7.1. Fixed in 0.7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Google Kubernetes Engine Jenkins Plugin is a plugin for the Jenkins automation server that allows users to deploy applications to Google Kubernetes Engine (GKE). It provides integration with GKE, enabling users to create, manage, and scale Kubernetes clusters for their applications. The plugin is widely used by developers and DevOps teams to streamline the deployment process and leverage the power of Kubernetes for containerized applications.
Vulnerability Detail
The vulnerability identified as CVE-2019-10445 in the Google Kubernetes Engine Jenkins Plugin allows attackers with Overall/Read permission to obtain limited information about the scope of a credential with an attacker-specified credentials ID. This means that an attacker with the necessary permissions can gather specific details about a credential, potentially leading to further exploitation or unauthorized access. The vulnerability was patched in version 0.7.1 of the plugin.
How To Fix
Minimum fixed version
0.7.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the patched version of the plugin.
Conclusion
The Google Kubernetes Engine Jenkins Plugin prior to version 0.7.1 is vulnerable to a missing permission check, which could allow attackers to obtain limited information about credentials. Users are advised to upgrade to version 0.7.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:google-kubernetes-engine →
FAQ
The vulnerability allows attackers with Overall/Read permission to gather limited information about a credential. While the immediate impact may be limited, it could potentially lead to further exploitation or unauthorized access.
Users of the Google Kubernetes Engine Jenkins Plugin prior to version 0.7.1 are affected by this vulnerability.
There is no specific evidence of this vulnerability being exploited in the wild at the time of this report.
The only known mitigation is to upgrade to version 0.7.1 or later of the Google Kubernetes Engine Jenkins Plugin.
Yes, the CVSS score for this vulnerability is 4.3, indicating a moderate severity.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:google-kubernetes-engine.
