Arbitrary File Read Affecting org.jenkins-ci.plugins:credentials package, versions [,2.1.19)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGJENKINSCIPLUGINS-174761
- published 21 May 2019
- disclosed 21 May 2019
- credit Yakov Shafranovich and Pankaj Upadhyay
Introduced: 21 May 2019
CVE-2019-10320 Open this link in a new tabHow to fix?
Upgrade org.jenkins-ci.plugins:credentials to version 2.1.19 or higher.
Overview
org.jenkins-ci.plugins:credentials is a plugin that provides a standardized API for other plugins to store and retrieve different types of credentials.
Affected versions of this package are vulnerable to Arbitrary File Read. The Credentials Plugin allowed the creation of Certificate credentials from a PKCS12 file on the Jenkins master. Users with permission to create or update credentials could use the associated form validation to confirm the existence of files with an attacker-specified path.
Additionally, they could create credentials from any valid PKCS12 file on the Jenkins master. With the ability to configure jobs to access these credentials, they could obtain the certificate content.