CVE-2019-16571: Jenkins RapidDeploy Plugin missing permission check

org.jenkins-ci.plugins:rapiddeploy-jenkins Updated 02 Oct 2025

Summary

24/05/2022

Disclosed on

CVE-2019-16571

CVE

No i

Fix available

Moderate

Severity

4.3

CVSS Score

CVE-2019-16571: Jenkins RapidDeploy Plugin missing permission check. Affects org.jenkins-ci.plugins:rapiddeploy-jenkins versions < 4.1. No fix is published. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The Jenkins RapidDeploy Plugin is a Maven-based plugin that allows users to deploy applications to a RapidDeploy server. It provides integration with RapidDeploy, a deployment automation tool used for deploying applications across various environments. The plugin enables users to configure deployment parameters and trigger deployments directly from Jenkins. It is widely used in CI/CD pipelines to automate the deployment process.

Vulnerability Detail

The Jenkins RapidDeploy Plugin version 4.1 and earlier suffer from a missing permission check vulnerability. This vulnerability allows attackers with Overall/Read permission to connect to an attacker-specified web server. By exploiting this vulnerability, an attacker can establish a connection to a web server of their choice, potentially leading to unauthorized access or data leakage. The vulnerability is rated as moderate with a CVSS score of 4.3.

How To Fix

No fixed version is published for this vulnerability.

Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →

Workaround

As a workaround, users can restrict the Overall/Read permission to trusted users only. By limiting access to this permission, the risk of unauthorized connections to attacker-specified web servers can be mitigated. However, this workaround may not be feasible in all scenarios, especially in environments where multiple users require Overall/Read permission.

Conclusion

The Jenkins RapidDeploy Plugin is vulnerable to a missing permission check, which can allow attackers to connect to attacker-specified web servers. It is crucial to update to the latest version of the plugin (4.2 or later) to mitigate this vulnerability. Additionally, restricting the Overall/Read permission can provide an extra layer of security. For further assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for org.jenkins-ci.plugins:rapiddeploy-jenkins →