CVE-2019-10457

A missing permission check in Jenkins Oracle Cloud Infrastructure Compute Classic Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.

• CWE-862

• http://www.openwall.com/lists/oss-security/2019/10/16/6Mailing List, Third Party Advisory
• https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1462Vendor Advisory
• http://www.openwall.com/lists/oss-security/2019/10/16/6Mailing List, Third Party Advisory
• https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1462Vendor Advisory

Published

Oct 16, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10451Jenkins SOASTA CloudTest Plugin stores credentials unencrypt…4.3
• CVE-2019-10452Jenkins View26 Test-Reporting Plugin stores credentials unen…4.3
• CVE-2019-10453Jenkins Delphix Plugin stores credentials unencrypted in its…7.8
• CVE-2019-10454A cross-site request forgery vulnerability in Jenkins Rundec…4.3
• CVE-2019-10455A missing permission check in Jenkins Rundeck Plugin allows …4.3
• CVE-2019-10456A cross-site request forgery vulnerability in Jenkins Oracle…4.3
• CVE-2019-10458Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier specifi…9.9
• CVE-2019-10459Jenkins Mattermost Notification Plugin 2.7.0 and earlier sto…6.5
• CVE-2019-1046An information disclosure vulnerability exists when the Wind…4.7
• CVE-2019-10460Jenkins Bitbucket OAuth Plugin 0.9 and earlier stored creden…7.8
• CVE-2019-10461Jenkins Dynatrace Application Monitoring Plugin 2.1.3 and ea…7.8
• CVE-2019-10462A cross-site request forgery vulnerability in Jenkins Dynatr…8.1