{"id":"CVE-2019-10301","details":"A missing permission check in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.","aliases":["GHSA-923w-9p3x-hmgw"],"modified":"2026-07-08T15:54:16.670345Z","published":"2019-04-18T17:29:00.507Z","references":[{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/108045"},{"type":"ADVISORY","url":"https://jenkins.io/security/advisory/2019-04-17/#SECURITY-1357"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jenkinsci/gitlab-plugin","events":[{"introduced":"0"},{"last_affected":"033e6c134141f847aa74b1d1d1ac62f2a9e05a62"}],"database_specific":{"cpe":"cpe:2.3:a:jenkins:gitlab:*:*:*:*:*:jenkins:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"1.5.11"}],"source":"CPE_RANGE"}}],"versions":["gitlab-plugin-1.5.11","gitlab-plugin-1.5.10","gitlab-plugin-1.5.9","gitlab-plugin-1.5.8","gitlab-plugin-1.5.7","gitlab-plugin-1.5.6","gitlab-plugin-1.5.5","gitlab-plugin-1.5.4","gitlab-plugin-1.5.3","gitlab-plugin-1.5.2","gitlab-plugin-1.5.1","gitlab-plugin-1.5.0","gitlab-plugin-1.4.8","gitlab-plugin-1.4.7","gitlab-plugin-1.4.6","gitlab-plugin-1.4.5","gitlab-plugin-1.4.4","gitlab-plugin-1.4.3","gitlab-plugin-1.4.2","gitlab-plugin-1.4.1","gitlab-plugin-1.4.0","gitlab-plugin-1.3.2","gitlab-plugin-1.3.1","gitlab-plugin-1.3.0","gitlab-plugin-1.2.5","gitlab-plugin-1.2.4","gitlab-plugin-1.2.3","gitlab-plugin-1.2.2","gitlab-plugin-1.2.1","gitlab-plugin-1.2.0","gitlab-plugin-1.1.31","gitlab-plugin-1.1.30","gitlab-plugin-1.1.29","gitlab-plugin-1.1.28","gitlab-plugin-1.1.26","gitlab-plugin-1.1.25","gitlab-plugin-1.1.24","gitlab-plugin-1.1.23","gitlab-plugin-1.1.22","gitlab-plugin-1.1.21","gitlab-plugin-1.1.20","gitlab-plugin-1.1.19","gitlab-plugin-1.1.18","gitlab-plugin-1.1.17","gitlab-plugin-1.1.16","gitlab-plugin-1.1.15","gitlab-plugin-1.1.14","gitlab-plugin-1.1.13","gitlab-plugin-1.1.12","gitlab-plugin-1.1.11","gitlab-plugin-1.1.10","gitlab-plugin-1.1.9","gitlab-plugin-1.1.8","gitlab-plugin-1.1.4","gitlab-plugin-1.1.3","gitlab-plugin-1.1.2","gitlab-plugin-1.1.1","gitlab-plugin-1.1.0","gitlab-plugin-1.0.11","gitlab-plugin-1.0.10","gitlab-plugin-1.0.9","gitlab-plugin-1.0.8","gitlab-plugin-1.0.7","gitlab-plugin-1.0.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-10301.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}