Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Jenkins Artifactory Plugin 3.2.2 and earlier connect to unauthorized servers

CVE-2019-10322 · published 7 years ago
Summary

An issue in the Jenkins Artifactory Plugin allows users with basic permissions to connect to any server using another user's login credentials. This means an attacker could trick a user with low-level access into sharing their credentials with a malicious server. To fix this, update the plugin to version 3.2.3 or later.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
maven jenkins-ci org.jenkins-ci.plugins:artifactory <= 3.2.2
– jfrog artifactory <= 3.2.2
cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:jenkins:*:*
Original advisory text
A missing permission check in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-spe...
A missing permission check in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.3 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published31 May 2019
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-gxm5-jrrf-5c4v · GHSA
CVE-2019-10322 · NVD
Track software like this
Free during beta