Description

A missing permission check in Jenkins Artifactory Plugin 3.2.3 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.

Remediation

References

CVE-2019-10323

Related Vulnerabilities

WordPress 4.8.x Multiple Vulnerabilities (4.8 - 4.8.11)

EspoCRM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-14546)

WordPress Plugin Livefyre Comments 3 Cross-Site Scripting (4.1.4)

WordPress Plugin mywebcounter Cross-Site Scripting (1.1)

WordPress Plugin St-Daily-Tip Cross-Site Request Forgery (4.7)

Severity

Medium

Classification

CVE-2019-10323 CWE-862 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities