CVE-2019-1003025

HIGH

Jenkins Cloud Foundry Plugin <2.3.1 - Info Disclosure

Title source: llm

Description

A exposure of sensitive information vulnerability exists in Jenkins Cloud Foundry Plugin 2.3.1 and earlier in AbstractCloudFoundryPushDescriptor.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_confirm

https://jenkins.io/security/advisory/2019-02-19/#SECURITY-876

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/107295

Scores

CVSS v3 8.8

EPSS 0.0007

EPSS Percentile 20.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-862

Status published

Products (2)

jenkins/cloud_foundry < 2.3.1

org.jenkins-ci.plugins/cloudfoundry 0 - 2.3.2Maven

Published Feb 20, 2019

Tracked Since Feb 18, 2026