CVE-2019-10344: Medium severity jenkins configuration as code vulnerability
Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with Overall/Read access to access the generated schema and documentation for this plugin containing detailed information about installed plugins.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10344?
CVE-2019-10344 has a medium severity impact due to missing permission checks allowing unauthorized access to sensitive configuration details.
How do I fix CVE-2019-10344?
To fix CVE-2019-10344, upgrade the Jenkins Configuration as Code Plugin to version 1.25 or later.
What kind of access does CVE-2019-10344 allow unauthorized users?
CVE-2019-10344 allows users with Overall/Read access to view the generated schema and documentation of the plugin.
What versions of Jenkins Configuration as Code are affected by CVE-2019-10344?
Versions of Jenkins Configuration as Code from 1.24 and earlier are affected by CVE-2019-10344.
Is there any impact on data integrity from CVE-2019-10344?
CVE-2019-10344 does not directly impact data integrity, but it exposes sensitive configuration information.