CVE-2019-16576
Description
A missing permission check in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing the Kubernetes service account token or credentials stored in Jenkins.
CWE
- (none)
Affected
- Jenkins project / Jenkins Alauda Kubernetes Suport Plugin — v=unspecified ≤2.3.0 [affected]; v=next of 2.3.0 <unspecified [unknown]
CVSS
- (none)
References
- https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1602 x_refsource_CONFIRM
- http://www.openwall.com/lists/oss-security/2019/12/17/1 mailing-list, x_refsource_MLIST
Source
cvelistV5-main/cves/2019/16xxx/CVE-2019-16576.json