CVE-2019-10409

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A missing permission check in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers with Overall/Read permission to trigger project generation from templates.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Project Inheritance Plugin	2.0.0 and earlier

References

http://www.openwall.com/lists/oss-security/2019/09/25/3Mailing List, Third Party Advisory
https://jenkins.io/security/advisory/2019-09-25/#SECURITY-401Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/09/25/3Mailing List, Third Party Advisory
https://jenkins.io/security/advisory/2019-09-25/#SECURITY-401Vendor Advisory

Timeline

Published: Sep 25, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-10417.0An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfu CVE-2019-104105.4Jenkins Log Parser Plugin 2.0 and earlier did not escape an error message, resulting in a cross-site scripting vulnerability exploitable by CVE-2019-104117.5Jenkins Inedo BuildMaster Plugin 2.4.0 and earlier transmitted configured credentials in plain text as part of the global Jenkins configurat CVE-2019-104127.5Jenkins Inedo ProGet Plugin 1.2 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration for CVE-2019-104136.5Jenkins Data Theorem: CI/CD Plugin 1.3 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they c CVE-2019-104146.5Jenkins Git Changelog Plugin 2.17 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could CVE-2019-104156.5Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in its global configuration file on the Jenkins CVE-2019-104166.5Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master wh CVE-2019-104179.9Jenkins Kubernetes :: Pipeline :: Kubernetes Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke a CVE-2019-104189.9Jenkins Kubernetes :: Pipeline :: Arquillian Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke a CVE-2019-104195.5Jenkins vFabric Application Director Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they CVE-2019-104205.5Jenkins Assembla Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by us