cve/2019/CVE-2019-10321.md

### [CVE-2019-10321](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10321)
![](https://img.shields.io/static/v1?label=Product&message=Jenkins%20Artifactory%20Plugin&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%203.2.2%20and%20earlier%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

### POC

#### Reference
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0787

#### Github
No PoCs found on GitHub currently.