PT-2019-14726

CVE-2019-16571

Published

2019-12-17

Updated

2023-10-25

Description by

CVSS 3.1

4.3

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins RapidDeploy Plugin versions 4.1 and earlier

Description A missing permission check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified web server.

Recommendations For Jenkins RapidDeploy Plugin versions 4.1 and earlier, update to a version that includes the necessary permission checks to prevent unauthorized connections.

Exploitability

Fix

Impacts

Researchers

Viktor Gazdag

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

CWE-285: Improper Authorization

Related identifiers

CVE-2019-16571