CVE-2019-10387

Name of the Vulnerable Software and Affected Versions Jenkins XL TestView Plugin versions 1.2.0 and earlier

Description A missing permission check in the XLTestView.XLTestDescriptor#doTestConnection function allows users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs, potentially capturing credentials stored in Jenkins.

Recommendations For Jenkins XL TestView Plugin versions 1.2.0 and earlier, consider disabling the XLTestView.XLTestDescriptor#doTestConnection function until a patch is available to prevent unauthorized access to credentials. Restrict access to the XL TestView Plugin to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.