medium6.5
CVE-2018-1000419
Jenkins HipChat Plugin allows attackers with Overall/Read access to obtain credential IDs
Impact
An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins. As of version 2.2.1, an enumeration of credentials IDs in this plugin requires Overall/Administer permission.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jvnet.hudson.plugins:hipchat | < 2.2.1 | 2.2.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Atlassian | Hipchat | through 2.2.0 |
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.securityfocus.com/bid/106532
- https://jenkins.io/security/advisory/2018-09-25/#SECURITY-984%20%282%29
- https://github.com/advisories/GHSA-798p-53r7-mgw9
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000419
- https://jenkins.io/security/advisory/2018-09-25/#SECURITY-984%20(2)