Jenkins Docker vulnerabilities

3 CVEs affecting Jenkins Docker, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-10342, published 2019-07-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-10341, published 2019-07-11. Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days. A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using…
CVE-2019-10340, published 2019-07-11. High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days. A cross-site request forgery vulnerability in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an…
CVE-2019-10342, published 2019-07-11. Medium severity, CVSS 4.3. EPSS: 1.4% chance of exploitation in the next 30 days. A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials…