CVE-2019-10386

Name of the Vulnerable Software and Affected Versions Jenkins XL TestView Plugin versions 1.2.0 and earlier

Description A cross-site request forgery issue allows users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs, potentially capturing credentials stored in Jenkins. The issue is related to the XLTestView.XLTestDescriptor#doTestConnection function.

Recommendations For Jenkins XL TestView Plugin versions 1.2.0 and earlier, consider disabling the XLTestView.XLTestDescriptor#doTestConnection function as a temporary workaround until a patch is available. Restrict access to the plugin to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.