Description
A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/12/17/1
https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1605%20%282%29
Related Vulnerabilities
CVE-2022-43434 Vulnerability in maven package io.jenkins.plugins:neuvector-vulnerability-scanner
CVE-2019-10379 Vulnerability in maven package org.jenkins-ci.plugins:gcm-notification
CVE-2020-2111 Vulnerability in maven package org.jenkins-ci.plugins:subversion
CVE-2023-24807 Vulnerability in maven package org.webjars.npm:undici
CVE-2020-11023 Vulnerability in maven package org.webjars.bower:jquery