CVE-2019-10457

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A missing permission check in Jenkins Oracle Cloud Infrastructure Compute Classic Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Oracle Cloud Infrastructure Compute Classic Plugin	1.0.0 and earlier

References

http://www.openwall.com/lists/oss-security/2019/10/16/6Mailing List, Third Party Advisory
https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1462Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/10/16/6Mailing List, Third Party Advisory
https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1462Vendor Advisory

Timeline

Published: Oct 16, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-104589.9Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers abl CVE-2019-104596.5Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configurati CVE-2019-10464.7An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker w CVE-2019-104607.8Jenkins Bitbucket OAuth Plugin 0.9 and earlier stored credentials unencrypted in the global config.xml configuration file on the Jenkins mas CVE-2019-104617.8Jenkins Dynatrace Application Monitoring Plugin 2.1.3 and earlier stored credentials unencrypted in its global configuration file on the Jen CVE-2019-104628.1A cross-site request forgery vulnerability in Jenkins Dynatrace Application Monitoring Plugin 2.1.3 and earlier allowed attackers to connect CVE-2019-104636.5A missing permission check in Jenkins Dynatrace Application Monitoring Plugin allows attackers with Overall/Read permission to connect to an CVE-2019-104648.8A cross-site request forgery vulnerability in Jenkins Deploy WebLogic Plugin allows attackers to connect to an attacker-specified URL using CVE-2019-104654.3A missing permission check in Jenkins Deploy WebLogic Plugin allows attackers with Overall/Read permission to connect to an attacker-specifi CVE-2019-104668.1An XML external entities (XXE) vulnerability in Jenkins 360 FireLine Plugin allows attackers with Overall/Read access to have Jenkins resolv CVE-2019-104676.5Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users w CVE-2019-104688.8A cross-site request forgery vulnerability in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers to connect to an attacker-