CVE-2019-10463: Jenkins Dynatrace Plugin Incorrect Default Permissions
Summary
CVE-2019-10463: Jenkins Dynatrace Plugin contains Incorrect Default Permissions. Affects org.jenkins-ci.plugins:dynatrace-dashboard versions < 2.1.5. Fixed in 2.1.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Dynatrace Plugin is a deprecated plugin that integrates Jenkins with Dynatrace Application Monitoring. It allows users to monitor the performance and availability of their Jenkins pipelines using Dynatrace. The plugin provides various features such as dashboards, charts, and alerts for monitoring purposes. However, a vulnerability in the plugin's default permissions can be exploited by attackers with Overall/Read permission.
Vulnerability Detail
The vulnerability (CVE-2019-10463) in the Jenkins Dynatrace Plugin arises from a missing permission check. Attackers with Overall/Read permission can connect to a URL of their choice using their own credentials. This can lead to unauthorized access and potential misuse of the plugin's functionality. The issue was addressed in version 2.1.5 of the plugin.
How To Fix
Latest published version: 2.1.5 as of 22 Oct 2026
The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update the plugin to the latest version.
Conclusion
The Jenkins Dynatrace Plugin contains a vulnerability that allows unauthorized access to a specified URL. It is crucial to update the plugin to version 2.1.5 or later to mitigate this risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:dynatrace-dashboard →
FAQ
The vulnerability allows attackers with Overall/Read permission to connect to a specified URL using their own credentials. This can lead to unauthorized access and potential misuse of the plugin's functionality.
There is no known exploit available for this vulnerability at the moment.
Yes, this vulnerability can be exploited remotely by attackers with Overall/Read permission.
Yes, this vulnerability has been patched in version 2.1.5 of the Jenkins Dynatrace Plugin.
As the Jenkins Dynatrace Plugin is deprecated, it is recommended to explore alternative plugins or monitoring solutions for integrating Jenkins with Dynatrace Application Monitoring.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:dynatrace-dashboard.
