Miggo Logo
Miggo Vulnerability Database
→
CVE-2019-10301

CVE-2019-10301: Jenkins GitLab Plugin missing permission checks

8.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2019-10301
GHSA ID
GHSA-923w-9p3x-hmgw
EPSS Score
0.21054%
CWE
CWE-862
Published
5/24/2022
Updated
12/13/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jenkins-ci.plugins:gitlab-pluginmaven<= 1.5.111.5.12

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability documentation explicitly references a missing permission check in GitLabConnectionConfig#doTestConnection. The commit diff shows this method was modified to add @RequirePOST and ADMINISTER permission checks, confirming it was the vulnerable entry point. The method's purpose (testing connections with arbitrary credentials/URLs) aligns perfectly with the described attack vector.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

J*nkins *itL** Plu*in *i* not p*r*orm p*rmission ****ks on * m*t*o* impl*m*ntin* *orm v*li**tion. T*is *llow** us*rs wit* Ov*r*ll/R*** ****ss to J*nkins to *onn**t to *n *tt**k*r-sp**i*i** URL usin* *tt**k*r-sp**i*i** *r***nti*ls I*s o*t*in** t*rou**

Reasoning

T** vuln*r**ility *o*um*nt*tion *xpli*itly r***r*n**s * missin* p*rmission ****k in `*itL***onn**tion*on*i*#*oT*st*onn**tion`. T** *ommit *i** s*ows t*is m*t*o* w*s mo*i*i** to *** @R*quir*POST *n* **MINIST*R p*rmission ****ks, *on*irmin* it w*s t**