CVE-2019-10333 Jenkins ElectricFlow Plugin Missing permission checks

What is CVE-2019-10333?

CVE-2019-10333 is a medium-severity missing authorization vulnerability in Jenkins ElectricFlow Plugin, published on 11 Jun 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Missing permission checks in Jenkins ElectricFlow Plugin 1.1.5 and earlier in various HTTP endpoints allowed users with Overall/Read access to obtain information about the Jenkins ElectricFlow Plugin configuration and configuration of connected ElectricFlow instances.

Weakness: CWE-862

Which versions are affected by CVE-2019-10333?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:electricflow. It affects 1 product.

Products include Jenkins Electricflow.

How do I fix CVE-2019-10333?

Upgrade org.jenkins-ci.plugins:electricflow to 1.1.7 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2019-10333 being exploited?

There is no known exploitation of CVE-2019-10333 in the wild and no public exploit code.

Other vulnerabilities in Jenkins ElectricFlow Plugin

• CVE-2019-10334 Jenkins ElectricFlow Plugin globally and unconditionally disabled SSL/TLS certificate validation Medium 6.5
• CVE-2019-10336 Jenkins ElectricFlow Plugin is vulnerable to reflected cross site scripting vulnerability Medium 6.1
• CVE-2019-10335 Jenkins ElectricFlow Plugin is vulnerable to stored cross site scripting vulnerability Medium 5.4
• CVE-2019-10331 Jenkins ElectricFlow Plugin cross-site request forgery vulnerability Medium 4.3
• CVE-2019-10332 Jenkins ElectricFlow Plugin missing permission check Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m8f2-9282-x38v.