CVE-2019-10319

Published: May 21, 2019Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

A missing permission check in Jenkins PAM Authentication Plugin 1.5 and earlier, except 1.4.1 in PamSecurityRealm.DescriptorImpl#doTest allowed users with Overall/Read permission to obtain limited information about the file /etc/shadow and the user Jenkins is running as.

Affected (6)

Products: Jenkins: Pluggable Authentication Module

Jenkins

1 product

Pluggable Authentication Module

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Jenkins Pluggable Authentication Module	Version 1.0
Jenkins Pluggable Authentication Module	Version 1.1
Jenkins Pluggable Authentication Module	Version 1.2
Jenkins Pluggable Authentication Module	Version 1.3
Jenkins Pluggable Authentication Module	Version 1.4
Jenkins Pluggable Authentication Module	Version 1.5