Vulnerability Details CVE-2019-10319
A missing permission check in Jenkins PAM Authentication Plugin 1.5 and earlier, except 1.4.1 in PamSecurityRealm.DescriptorImpl#doTest allowed users with Overall/Read permission to obtain limited information about the file /etc/shadow and the user Jenkins is running as.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 9.0%
CVSS Severity
CVSS v3 Score 4.3
CVSS v2 Score 4.0
References
Products affected by CVE-2019-10319
-
cpe:2.3:a:jenkins:pluggable_authentication_module:1.0
-
cpe:2.3:a:jenkins:pluggable_authentication_module:1.1
-
cpe:2.3:a:jenkins:pluggable_authentication_module:1.2
-
cpe:2.3:a:jenkins:pluggable_authentication_module:1.3
-
cpe:2.3:a:jenkins:pluggable_authentication_module:1.4
-
cpe:2.3:a:jenkins:pluggable_authentication_module:1.5