CVE-2019-10319

A missing permission check in Jenkins PAM Authentication Plugin 1.5 and earlier, except 1.4.1 in PamSecurityRealm.DescriptorImpl#doTest allowed users with Overall/Read permission to obtain limited information about the file /etc/shadow and the user Jenkins is running as.

• CWE-862

• http://www.openwall.com/lists/oss-security/2019/05/21/1Mailing List, Third Party Advisory
• https://jenkins.io/security/advisory/2019-05-21/#SECURITY-1316Vendor Advisory
• http://www.openwall.com/lists/oss-security/2019/05/21/1Mailing List, Third Party Advisory
• https://jenkins.io/security/advisory/2019-05-21/#SECURITY-1316Vendor Advisory

Published

May 21, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10313Jenkins Twitter Plugin stores credentials unencrypted in its…8.8
• CVE-2019-10314Jenkins Koji Plugin disables SSL/TLS and hostname verificati…
• CVE-2019-10315Jenkins GitHub Authentication Plugin 0.31 and earlier did no…
• CVE-2019-10316Jenkins Aqua MicroScanner Plugin 1.0.5 and earlier stored cr…8.8
• CVE-2019-10317Jenkins SiteMonitor Plugin 0.5 and earlier disabled SSL/TLS …
• CVE-2019-10318Jenkins Azure AD Plugin 0.3.3 and earlier stored the client …8.8
• CVE-2019-1032A cross-site-scripting (XSS) vulnerability exists when Micro…
• CVE-2019-10320Jenkins Credentials Plugin 2.1.18 and earlier allowed users …
• CVE-2019-10321A cross-site request forgery vulnerability in Jenkins Artifa…
• CVE-2019-10322A missing permission check in Jenkins Artifactory Plugin 3.2…4.3
• CVE-2019-10323A missing permission check in Jenkins Artifactory Plugin 3.2…4.3
• CVE-2019-10324A cross-site request forgery vulnerability in Jenkins Artifa…