CVE-2019-10465

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A missing permission check in Jenkins Deploy WebLogic Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials, or determine whether a file or directory with an attacker-specified path exists on the Jenkins master file system.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Deploy WebLogic Plugin	4.1 and earlier

References

http://www.openwall.com/lists/oss-security/2019/10/23/2Mailing List, Third Party Advisory
https://jenkins.io/security/advisory/2019-10-23/#SECURITY-820Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/10/23/2Mailing List, Third Party Advisory
https://jenkins.io/security/advisory/2019-10-23/#SECURITY-820Vendor Advisory

Timeline

Published: Oct 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-104668.1An XML external entities (XXE) vulnerability in Jenkins 360 FireLine Plugin allows attackers with Overall/Read access to have Jenkins resolv CVE-2019-104676.5Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users w CVE-2019-104688.8A cross-site request forgery vulnerability in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers to connect to an attacker-CVE-2019-104696.5A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers with Overall/Read permission to connect to CVE-2019-10474.7An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker w CVE-2019-104706.5A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin in form-related methods allowed users with Overall/Read acc CVE-2019-104718.8A cross-site request forgery vulnerability in Jenkins Libvirt Slaves Plugin allows attackers to connect to an attacker-specified SSH server CVE-2019-104726.5A missing permission check in Jenkins Libvirt Slaves Plugin allows attackers with Overall/Read permission to connect to an attacker-specifie CVE-2019-104734.3A missing permission check in Jenkins Libvirt Slaves Plugin in form-related methods allowed users with Overall/Read access to enumerate cred CVE-2019-104744.3A missing permission check in Jenkins Global Post Script Plugin in allowed users with Overall/Read access to list the scripts available to t CVE-2019-104756.1A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into CVE-2019-104767.8Jenkins Zulip Plugin 1.1.0 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they coul