CVE-2019-10340

Name of the Vulnerable Software and Affected Versions Jenkins Docker Plugin versions 1.1.6 and earlier

Description A cross-site request forgery issue allows users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs, potentially capturing credentials stored in Jenkins. This is possible through the DockerAPI.DescriptorImpl#doTestConnection method.

Recommendations For Jenkins Docker Plugin versions 1.1.6 and earlier, consider disabling the DockerAPI.DescriptorImpl#doTestConnection method until a patch is available to prevent potential exploitation. Restrict access to the Docker Plugin to minimize the risk of credentials being captured. At the moment, there is no information about a newer version that contains a fix for this vulnerability.