CVE-2019-1003025

A exposure of sensitive information vulnerability exists in Jenkins Cloud Foundry Plugin 2.3.1 and earlier in AbstractCloudFoundryPushDescriptor.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

• CWE-862

• http://www.securityfocus.com/bid/107295Third Party Advisory, VDB Entry
• https://jenkins.io/security/advisory/2019-02-19/#SECURITY-876Vendor Advisory
• http://www.securityfocus.com/bid/107295Third Party Advisory, VDB Entry
• https://jenkins.io/security/advisory/2019-02-19/#SECURITY-876Vendor Advisory

Published

Feb 20, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1003019An session fixation vulnerability exists in Jenkins GitHub A…
• CVE-2019-1003020A server-side request forgery vulnerability exists in Jenkin…
• CVE-2019-1003021An exposure of sensitive information vulnerability exists in…
• CVE-2019-1003022A denial of service vulnerability exists in Jenkins Monitori…
• CVE-2019-1003023A cross-site scripting vulnerability exists in Jenkins Warni…
• CVE-2019-1003024A sandbox bypass vulnerability exists in Jenkins Script Secu…8.8
• CVE-2019-1003026A server-side request forgery vulnerability exists in Jenkin…
• CVE-2019-1003027A server-side request forgery vulnerability exists in Jenkin…
• CVE-2019-1003028A server-side request forgery vulnerability exists in Jenkin…
• CVE-2019-1003029A sandbox bypass vulnerability exists in Jenkins Script Secu…9.9
• CVE-2019-1003030A sandbox bypass vulnerability exists in Jenkins Pipeline: G…9.9
• CVE-2019-1003031A sandbox bypass vulnerability exists in Jenkins Matrix Proj…9.9