CVE-2019-10342

Name of the Vulnerable Software and Affected Versions Jenkins Docker Plugin versions 1.1.6 and earlier

Description A missing permission check in the Jenkins Docker Plugin allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. This issue is related to various 'fillCredentialsIdItems' methods.

Recommendations For Jenkins Docker Plugin versions 1.1.6 and earlier, consider restricting access to the 'fillCredentialsIdItems' methods until a patch is available. As a temporary workaround, review and restrict Overall/Read access to minimize the risk of credentials enumeration. At the moment, there is no information about a newer version that contains a fix for this vulnerability.