CVE-2019-10439

Name of the Vulnerable Software and Affected Versions Jenkins CRX Content Package Deployer Plugin versions 1.8.1 and earlier Jenkins CRX Content Package Deployer Plugin versions prior to 1.9

Description A missing permission check in the Jenkins CRX Content Package Deployer Plugin in various doFillCredentialsIdItems methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.

Recommendations For Jenkins CRX Content Package Deployer Plugin versions 1.8.1 and earlier, update to version 1.9 or later to resolve the issue. For Jenkins CRX Content Package Deployer Plugin versions prior to 1.9, update to version 1.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the doFillCredentialsIdItems methods until a patch is available.