CVE-2019-10340

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A cross-site request forgery vulnerability in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Docker Plugin	1.1.6 and earlier

References

http://www.openwall.com/lists/oss-security/2019/07/11/4Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/109156Broken Link, Third Party Advisory, VDB Entry
https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1010Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/07/11/4Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/109156Broken Link, Third Party Advisory, VDB Entry
https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1010Vendor Advisory

Timeline

Published: Jul 11, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-103416.5A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overal CVE-2019-103424.3A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall CVE-2019-103433.3Jenkins Configuration as Code Plugin 1.24 and earlier did not properly apply masking to values expected to be hidden when logging the config CVE-2019-103444.3Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with Overall/Read CVE-2019-103455.5Jenkins Configuration as Code Plugin 1.20 and earlier did not treat the proxy password as a secret to be masked when logging or encrypted fo CVE-2019-103466.1A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject arbitrar CVE-2019-103478.8Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users with access to the mas CVE-2019-103488.8Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Exte CVE-2019-103495.4A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure j CVE-2019-10357.8A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who CVE-2019-103508.8Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users CVE-2019-103518.8Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users wit