PT-2019-11758 · Jenkins · Jenkins Configuration As Code Plugin+1

Wadeck Follonier · Published 2019-07-31 · Updated 2023-10-25 · CVE-2019-10362

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Configuration as Code Plugin versions 1.24 and earlier

Description The issue allows attackers with permission to change Jenkins system configuration to obtain the values of environment variables due to variable interpolation during configuration import when exporting. This occurs because values are not properly escaped, resulting in the exposure of sensitive information.

Recommendations For Jenkins Configuration as Code Plugin versions 1.24 and earlier, update to a version later than 1.24 to resolve the issue.

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2019-10362

GHSA-5R6P-P9R6-R326

Affected Products

Jenkins

Jenkins Configuration As Code Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-10362 · Security Note
• https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1446 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5r6p-p9r6-r326 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10362 · Vendor Advisory
• https://github.com/jenkinsci/configuration-as-code-plugin/commit/b48a292112c532ab1447b864c7d30c2cae733ac8 · Note
• http://openwall.com/lists/oss-security/2019/07/31/1 · Note