« Volver al listado

CVE-2019-10319

Estado: ModificadaMedia (4.3)—

A missing permission check in Jenkins PAM Authentication Plugin 1.5 and earlier, except 1.4.1 in PamSecurityRealm.DescriptorImpl#doTest allowed users with Overall/Read permission to obtain limited information about the file /etc/shadow and the user Jenkins is running as.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Jenkins — Pluggable Authentication Module

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-10319",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "jenkinsci-cert@googlegroups.com",
      "affectedData": [
        {
          "vendor": "Jenkins project",
          "product": "Jenkins PAM Authentication Plugin",
          "versions": [
            {
              "status": "affected",
              "version": "1.5 and earlier, except 1.4.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-05-21T13:29:00.227",
  "references": [
    {
      "url": "http://www.openwall.com/lists/oss-security/2019/05/21/1",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "jenkinsci-cert@googlegroups.com"
    },
    {
      "url": "https://jenkins.io/security/advisory/2019-05-21/#SECURITY-1316",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "jenkinsci-cert@googlegroups.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2019/05/21/1",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://jenkins.io/security/advisory/2019-05-21/#SECURITY-1316",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A missing permission check in Jenkins PAM Authentication Plugin 1.5 and earlier, except 1.4.1 in PamSecurityRealm.DescriptorImpl#doTest allowed users with Overall/Read permission to obtain limited information about the file /etc/shadow and the user Jenkins is running as."
    },
    {
      "lang": "es",
      "value": "Una falta  de comprobación de permisos en Jenkins PAM Authentication Plugin 1.5 y anteriores, excepto 1.4.1 en PamSecurityRealm.DescriptorImpl#doTest permitió a los usuarios con permiso Overall/Read obtener información limitada sobre el archivo /etc/shadow y el usuario está ejecutando como Jenkins."
    }
  ],
  "lastModified": "2026-06-17T02:10:42.487",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jenkins:pluggable_authentication_module:1.0:*:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0ECE6679-5FDE-4AAD-8BCB-930E8EE0E654"
            },
            {
              "criteria": "cpe:2.3:a:jenkins:pluggable_authentication_module:1.1:*:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B8F34939-9349-4C7F-B6A1-E8E1255C5F24"
            },
            {
              "criteria": "cpe:2.3:a:jenkins:pluggable_authentication_module:1.2:*:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2EBF6353-EDE3-41E2-99C1-ED3065424AFE"
            },
            {
              "criteria": "cpe:2.3:a:jenkins:pluggable_authentication_module:1.3:*:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "169841C2-E91B-4172-ABBC-C6B253328AC0"
            },
            {
              "criteria": "cpe:2.3:a:jenkins:pluggable_authentication_module:1.4:*:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA895605-9573-4149-A5DA-438CA6F0DA89"
            },
            {
              "criteria": "cpe:2.3:a:jenkins:pluggable_authentication_module:1.5:*:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5BB5D73-727B-45BF-8C24-A68185C5B559"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "jenkinsci-cert@googlegroups.com"
}