CVE-2019-10363: Medium severity jenkins configuration as code vulnerability
Published Jul 31, 2019
·Updated
Jenkins Configuration as Code Plugin 1.24 and earlier did not reliably identify sensitive values expected to be exported in their encrypted form.
Affected Software
2 affected componentsFixes available
maven/io.jenkins:configuration-as-code<=1.24
1.25
jenkins Configuration As Code Jenkins<=1.24
Event History
Jul 31, 2019
CVE Published
via MITRE·12:45 PM
Data Sourced
via MITRE·12:45 PM
Description
May 24, 2022
Advisory Published
04:51 PM
Frequently Asked Questions
1
What is the severity of CVE-2019-10363?
CVE-2019-10363 is classified as a medium severity vulnerability.
2
How do I fix CVE-2019-10363?
To fix CVE-2019-10363, update the Jenkins Configuration as Code Plugin to version 1.25 or later.
3
What impact does CVE-2019-10363 have on Jenkins users?
CVE-2019-10363 can lead to sensitive configuration values being exposed in their plaintext form.
4
Which versions of Jenkins Configuration as Code are affected by CVE-2019-10363?
CVE-2019-10363 affects versions 1.24 and earlier of the Jenkins Configuration as Code Plugin.
5
Is there a workaround for CVE-2019-10363?
There is no known workaround for CVE-2019-10363; updating the plugin is recommended.