CVE-2019-10362: Infoleak
First published: Wed Jul 31 2019(Updated: )
Jenkins Configuration as Code Plugin 1.24 and earlier did not escape values resulting in variable interpolation during configuration import when exporting, allowing attackers with permission to change Jenkins system configuration to obtain the values of environment variables.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/io.jenkins:configuration-as-code | <=1.24 | 1.25 |
| Jenkins Configuration as Code | <=1.24 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2019/07/31/1
- https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1446
- https://nvd.nist.gov/vuln/detail/CVE-2019-10362
- https://github.com/jenkinsci/configuration-as-code-plugin/commit/b48a292112c532ab1447b864c7d30c2cae733ac8
- https://github.com/advisories/GHSA-5r6p-p9r6-r326 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2019-10362?
CVE-2019-10362 has a high severity rating due to potential exposure of sensitive configuration values.
How do I fix CVE-2019-10362?
To fix CVE-2019-10362, upgrade the Jenkins Configuration as Code Plugin to version 1.25 or later.
What is the impact of CVE-2019-10362?
The impact of CVE-2019-10362 allows attackers with permission to modify Jenkins configurations to leak the values of environment variables.
Which versions of Jenkins are affected by CVE-2019-10362?
CVE-2019-10362 affects Jenkins Configuration as Code Plugin versions 1.24 and earlier.
Is CVE-2019-10362 a remote or local vulnerability?
CVE-2019-10362 is a local vulnerability, requiring user permissions to exploit the configuration changes.
- collector/github-advisory-latest
- alias/GHSA-5r6p-p9r6-r326
- alias/CVE-2019-10362
- collector/github-advisory
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/author
- agent/references
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-index
- collector/nvd-cve
- package-manager/maven
- vendor/jenkins
- canonical/jenkins configuration as code
- version/jenkins configuration as code/1.24