CVE-2019-10362: Infoleak
First published: Wed Jul 31 2019(Updated: )
Jenkins Configuration as Code Plugin 1.24 and earlier did not escape values resulting in variable interpolation during configuration import when exporting, allowing attackers with permission to change Jenkins system configuration to obtain the values of environment variables.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Configuration As Code | <=1.24 | |
| maven/io.jenkins:configuration-as-code | <=1.24 | 1.25 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2019/07/31/1
- https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1446
- https://nvd.nist.gov/vuln/detail/CVE-2019-10362
- https://github.com/jenkinsci/configuration-as-code-plugin/commit/b48a292112c532ab1447b864c7d30c2cae733ac8
- https://github.com/advisories/GHSA-5r6p-p9r6-r326 (Advisory)
- collector/nvd-index
- collector/nvd-api
- collector/github-advisory-latest
- alias/GHSA-5r6p-p9r6-r326
- alias/CVE-2019-10362
- collector/nvd-cve
- collector/github-advisory
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/author
- agent/references
- agent/last-modified-date
- agent/description
- agent/tags
- agent/first-publish-date
- agent/event
- agent/trending
- vendor/jenkins
- canonical/jenkins configuration as code
- version/jenkins configuration as code/1.24
- package-manager/maven