PT-2019-11743 · Jenkins · Jenkins Configuration As Code Plugin+1

Mikaãl Barbero · Publicado 2019-07-31 · Atualizado 2023-10-25 · CVE-2019-10344

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Configuration as Code Plugin versions 1.24 and earlier

Description The issue concerns missing permission checks in various HTTP endpoints, allowing users with Overall/Read access to access the generated schema and documentation for the plugin. This documentation contains detailed information about installed plugins.

Recommendations For Jenkins Configuration as Code Plugin versions 1.24 and earlier, consider restricting access to the affected HTTP endpoints until a patch is available. As a temporary workaround, review and limit the Overall/Read access to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Improper Authorization

Enumeração de Fraquezas

CWE-862

CWE-285

Identificadores relacionados

CVE-2019-10344

GHSA-MQR8-3V8J-46WV

Produtos afetados

Jenkins

Jenkins Configuration As Code Plugin

Referências · 6

• https://github.com/jenkinsci/configuration-as-code-plugin/commit/1c531c1a46fc1da6a82cd728bf66428083d30fef · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10344 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-mqr8-3v8j-46wv · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-10344 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2019/07/31/1 · Nota
• https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1290 · Aviso do Fabricante