CVE-2019-10333

Missing permission checks in Jenkins ElectricFlow Plugin 1.1.5 and earlier in various HTTP endpoints allowed users with Overall/Read access to obtain information about the Jenkins ElectricFlow Plugin configuration and configuration of connected ElectricFlow instances.

• CWE-862

• http://www.openwall.com/lists/oss-security/2019/06/11/1Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/108747Third Party Advisory, VDB Entry
• https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1410%20%282%29
• http://www.openwall.com/lists/oss-security/2019/06/11/1Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/108747Third Party Advisory, VDB Entry
• https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1410%20%282%29

Published

Jun 11, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10328Jenkins Pipeline Remote Loader Plugin 1.4 and earlier provid…
• CVE-2019-10329Jenkins InfluxDB Plugin 1.21 and earlier stored credentials …8.8
• CVE-2019-1033A cross-site-scripting (XSS) vulnerability exists when Micro…
• CVE-2019-10330Jenkins Gitea Plugin 1.1.1 and earlier did not implement tru…7.5
• CVE-2019-10331A cross-site request forgery vulnerability in Jenkins Electr…
• CVE-2019-10332A missing permission check in Jenkins ElectricFlow Plugin 1.…4.3
• CVE-2019-10334Jenkins ElectricFlow Plugin 1.1.5 and earlier disabled SSL/T…
• CVE-2019-10335A stored cross site scripting vulnerability in Jenkins Elect…
• CVE-2019-10336A reflected cross site scripting vulnerability in Jenkins El…
• CVE-2019-10337An XML external entities (XXE) vulnerability in Jenkins Toke…
• CVE-2019-10338A cross-site request forgery vulnerability in Jenkins JX Res…
• CVE-2019-10339A missing permission check in Jenkins JX Resources Plugin 1.…8.8