CVE-2019-10322

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A missing permission check in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Artifactory Plugin	3.2.2 and earlier

References

http://www.openwall.com/lists/oss-security/2019/05/31/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/108540Third Party Advisory, VDB Entry
https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1015%20%281%29
https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0787Exploit, Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/05/31/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/108540Third Party Advisory, VDB Entry
https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1015%20%281%29
https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0787Exploit, Third Party Advisory

Timeline

Published: May 31, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-103234.3A missing permission check in Jenkins Artifactory Plugin 3.2.3 and earlier in various 'fillCredentialsIdItems' methods allowed users with Ov CVE-2019-103246.5A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiAction CVE-2019-103255.4A cross-site scripting vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attacker with Job/Configure permission to injec CVE-2019-103264.3A cross-site request forgery vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attackers to reset warning counts for fut CVE-2019-103278.1An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to contro CVE-2019-103289.9Jenkins Pipeline Remote Loader Plugin 1.4 and earlier provided a custom whitelist for script security that allowed attackers to invoke arbit CVE-2019-103298.8Jenkins InfluxDB Plugin 1.21 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they ca CVE-2019-10335.4A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reques CVE-2019-103307.5Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to chan CVE-2019-103314.3A cross-site request forgery vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed attack CVE-2019-103324.3A missing permission check in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed users with Overall/Rea CVE-2019-103334.3Missing permission checks in Jenkins ElectricFlow Plugin 1.1.5 and earlier in various HTTP endpoints allowed users with Overall/Read access