VYPR
← All advisories
Moderate severityNVD Advisory· Published Oct 16, 2019· Updated Aug 4, 2024

CVE-2019-10442

CVE-2019-10442

Description

Missing permission check in Jenkins iceScrum Plugin allows attackers with Overall/Read permission to connect to arbitrary URLs using attacker-specified credentials.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Missing permission check in Jenkins iceScrum Plugin allows attackers with Overall/Read permission to connect to arbitrary URLs using attacker-specified credentials.

The Jenkins iceScrum Plugin version 1.1.5 and earlier contains a missing permission check in a method that allows connecting to external URLs. This flaw enables any user with Overall/Read permission to trigger the plugin to make HTTP requests to attacker-controlled servers using credentials specified by the attacker [1][2].

An attacker needs only Overall/Read permission, which is commonly granted to many Jenkins users. By specifying a malicious URL and credentials (e.g., stored Jenkins credentials or arbitrary strings), the attacker can cause the plugin to attempt a connection. This can be exploited to capture credentials by having the plugin send them to a server under the attacker's control, or to perform server-side request forgery (SSRF) against internal systems [1].

The impact includes potential credential theft and network reconnaissance. The vulnerability is rated medium severity (CVSS 4.3) [1][2].

The issue is fixed in iceScrum Plugin version 1.1.6. Users should upgrade to this version or later. No workaround is available [1][2].

References
  1. Jenkins Security Advisory 2019-10-16
  2. security - Multiple vulnerabilities in Jenkins plugins

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.jenkins-ci.plugins:icescrumMaven
< 1.1.61.1.6

Affected products

2

Patches

1
2e248f7e2cfc

fix SECURITY-1484

https://github.com/jenkinsci/icescrum-pluginvbarrierSep 30, 2019via ghsa
commit
1 file changed · +4 −2
  • src/main/java/com/kagilum/plugins/icescrum/IceScrumProjectProperty.java+4 −2 modified
    @@ -23,6 +23,7 @@
 import hudson.model.*;
 import hudson.util.FormValidation;
 import hudson.util.Secret;
+import jenkins.model.Jenkins;
 import net.sf.json.JSONObject;
 import org.kohsuke.stapler.DataBoundConstructor;
 import org.kohsuke.stapler.QueryParameter;
@@ -81,6 +82,7 @@ public String getDisplayName() {
 
         @RequirePOST
         public FormValidation doCheckUrl(@QueryParameter String value) {
+            Jenkins.getInstance().checkPermission(Jenkins.ADMINISTER);
             if(IceScrumProjectSettings.isValidUrl(value))
                 return FormValidation.ok();
             else
@@ -90,7 +92,7 @@ public FormValidation doCheckUrl(@QueryParameter String value) {
         @RequirePOST
         public FormValidation doLoginCheck(@QueryParameter("icescrum.accessToken") final String accessToken,
                                            @QueryParameter("icescrum.url") final String url) throws IOException, ServletException {
-
+            Jenkins.getInstance().checkPermission(Jenkins.ADMINISTER);
             if(!IceScrumProjectSettings.isValidUrl(url))
                 return FormValidation.error(Messages.IceScrumProjectProperty_icescrum_error_url());
 
@@ -110,7 +112,7 @@ public FormValidation doLoginCheck(@QueryParameter("icescrum.accessToken") final
         public FormValidation doOldLoginCheck(@QueryParameter("icescrum.username") final String username,
                                               @QueryParameter("icescrum.password") final Secret password,
                                               @QueryParameter("icescrum.url") final String url) throws IOException, ServletException {
-
+            Jenkins.getInstance().checkPermission(Jenkins.ADMINISTER);
             if(!IceScrumProjectSettings.isValidUrl(url))
                 return FormValidation.error(Messages.IceScrumProjectProperty_icescrum_error_url());

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.