PT-2019-11743 · Jenkins · Jenkins Configuration As Code Plugin+1

Mikaãl Barbero · Published 2019-07-31 · Updated 2023-10-25 · CVE-2019-10344

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Configuration as Code Plugin versions 1.24 and earlier

Description The issue concerns missing permission checks in various HTTP endpoints, allowing users with Overall/Read access to access the generated schema and documentation for the plugin. This documentation contains detailed information about installed plugins.

Recommendations For Jenkins Configuration as Code Plugin versions 1.24 and earlier, consider restricting access to the affected HTTP endpoints until a patch is available. As a temporary workaround, review and limit the Overall/Read access to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Improper Authorization

Weakness Enumeration

CWE-862

CWE-285

Related Identifiers

CVE-2019-10344

GHSA-MQR8-3V8J-46WV

Affected Products

Jenkins

Jenkins Configuration As Code Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-10344 · Security Note
• https://osv.dev/vulnerability/GHSA-mqr8-3v8j-46wv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10344 · Vendor Advisory
• https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1290 · Vendor Advisory
• https://github.com/jenkinsci/configuration-as-code-plugin/commit/1c531c1a46fc1da6a82cd728bf66428083d30fef · Note
• http://openwall.com/lists/oss-security/2019/07/31/1 · Note