Medium severity6.5NVD Advisory· Published Aug 7, 2019· Updated Jun 17, 2026
CVE-2019-10369
CVE-2019-10369
Description
A missing permission check in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.jenkins-ci.plugins:jclouds-jenkinsMaven | < 2.15 | 2.15 |
Affected products
3- Range: 2.14 and earlier
Patches
Vulnerability mechanics
References
10- www.openwall.com/lists/oss-security/2019/08/07/1nvdMailing ListThird Party AdvisoryWEB
- github.com/advisories/GHSA-7wxc-7qrg-rg6wghsaADVISORY
- jenkins.io/security/advisory/2019-08-07/nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2019-10369ghsaADVISORY
- lists.apache.org/thread.html/r42b7ff290ed5ec8f27f12c54fff54462ffc4bcf6a5015c37fece94ac%40%3Cnotifications.jclouds.apache.org%3EnvdWEB
- lists.apache.org/thread.html/r42b7ff290ed5ec8f27f12c54fff54462ffc4bcf6a5015c37fece94ac@%3Cnotifications.jclouds.apache.org%3EghsaWEB
- lists.apache.org/thread.html/r6c4693d03d15391814c647742db49a4d9937fa34573fb66103d57b45%40%3Cnotifications.jclouds.apache.org%3EnvdWEB
- lists.apache.org/thread.html/r6c4693d03d15391814c647742db49a4d9937fa34573fb66103d57b45@%3Cnotifications.jclouds.apache.org%3EghsaWEB
- lists.apache.org/thread.html/r725e55670dbdd214f3cfdfea255b72a75fa9a4f0c6c9d109b29c7881%40%3Cnotifications.jclouds.apache.org%3EnvdWEB
- lists.apache.org/thread.html/r725e55670dbdd214f3cfdfea255b72a75fa9a4f0c6c9d109b29c7881@%3Cnotifications.jclouds.apache.org%3EghsaWEB
News mentions
0No linked articles in our index yet.