CVE-2019-10469: Jenkins Kubernetes CI/CD Plugin Improper Authorization
Summary
CVE-2019-10469: Jenkins Kubernetes CI/CD Plugin vulnerable to Improper Authorization. Affects com.elasticbox.jenkins-ci.plugins:kubernetes-ci versions < 1.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Kubernetes CI/CD Plugin is a Maven package (com.elasticbox.jenkins-ci.plugins:kubernetes-ci) that provides integration between Jenkins and Kubernetes for continuous integration and continuous deployment (CI/CD) workflows. It allows users to manage and deploy applications on Kubernetes clusters directly from Jenkins. However, this plugin is vulnerable to an improper authorization issue.
Vulnerability Detail
The vulnerability (CVE-2019-10469) in the Jenkins Kubernetes CI/CD Plugin arises from a missing permission check. Attackers with Overall/Read permission can exploit this vulnerability to connect to a specified URL using attacker-specified credentials IDs obtained through another method. By doing so, they can capture credentials stored in Jenkins. This can lead to unauthorized access and potential misuse of sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As the Jenkins Kubernetes CI/CD Plugin is no longer distributed, there is no official workaround provided. However, users can explore alternative plugins or solutions that offer similar integration between Jenkins and Kubernetes for CI/CD workflows.
Conclusion
The Jenkins Kubernetes CI/CD Plugin is vulnerable to an improper authorization issue, allowing attackers with Overall/Read permission to capture credentials stored in Jenkins. As Jenkins has suspended distribution of this plugin, it is advisable to explore alternative solutions or plugins that provide similar functionality and are actively maintained. Promptly addressing vulnerabilities is crucial to mitigate potential risks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for com.elasticbox.jenkins-ci.plugins:kubernetes-ci →
FAQ
The vulnerability allows attackers with Overall/Read permission to capture credentials stored in Jenkins, potentially leading to unauthorized access and misuse of sensitive information.
Yes, this vulnerability can be exploited remotely by attackers with Overall/Read permission.
While it is recommended to update the Jenkins Kubernetes CI/CD Plugin, Jenkins has suspended distribution of this plugin, indicating that it may no longer be actively maintained or supported. It is advisable to consider alternative solutions or plugins.
There are no specific instances of this vulnerability being exploited mentioned in the provided information. However, it is important to address vulnerabilities promptly to mitigate potential risks.
For more information about this vulnerability, you can refer to the GitHub Advisory Database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-hch9-6qrj-5f49/GHSA-hch9-6qrj-5f49.json
Related vulnerabilities
Recent vulnerabilities recorded for com.elasticbox.jenkins-ci.plugins:kubernetes-ci.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
