CVE-2019-10339

Jenkins JX Resources Plugin missing permission check

8.8 HighFix available

A missing permission check in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed users with Overall/Read access to have Jenkins connect to an attacker-specified Kubernetes server, potentially leaking credentials.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.81%Up 1.0 points since Apr 14, 2021

What each source reports

NVD Score used 8.8

Record: CVE-2019-10339
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness: CWE-862
Updated: 2026-11-02

CVE List No score

Record: CVE-2019-10339
Updated: 2026-11-02

EUVDEUVD-2022-5843 No score

Record: EUVD-2022-5843
Updated: 2026-11-03

GitHub AdvisoriesGHSA-xqqr-mq8x-22qx 5.4

Jenkins JX Resources Plugin missing permission check

Jenkins jx-resources Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified Kubernetes server and obtain information about an attacker-specified namespace. Doing so might also leak service account credentials used for the connection. Additionally, it allowed attackers to obtain the value of any attacker-specified environment variable for the Jenkins controller process.

Additionally, this form validation method did not require POST requests, resulting in a cross-site request forgery vulnerability.

This form validation method now requires POST requests and Overall/Administer permissions.

Record: GHSA-xqqr-mq8x-22qx
CVSS 3.0: 5.4 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-862
Updated: 2026-11-02

OSV 8.8

Record: CVE-2019-10339
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-xqqr-mq8x-22qx 5.4

Jenkins JX Resources Plugin missing permission check

Additionally, this form validation method did not require POST requests, resulting in a cross-site request forgery vulnerability.

This form validation method now requires POST requests and Overall/Administer permissions.

Record: GHSA-xqqr-mq8x-22qx
CVSS 3.0: 5.4 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-862
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.jenkins-ci.plugins:jx-resources` Maven	through 1.0.36	1.0.37
`org.jenkins-ci.plugins:jx-resources` Maven	before 1.0.37, plus listed versions 1.0.01.0.11.0.141.0.151.0.2 Show 15 moreShow less 1.0.241.0.251.0.261.0.271.0.291.0.301.0.311.0.321.0.331.0.341.0.351.0.361.0.41.0.51.0.6	1.0.37

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-10339 is a high vulnerability (CVSS 8.8) in Jenkins Jx Resources, published June 11, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.81%, the 78th percentile. Fixed in org.jenkins-ci.plugins:jx-resources 1.0.37.