PT-2019-11801 · Jenkins · Mask Passwords Plugin+2

Published 2019-09-25 · Updated 2023-10-25 · CVE-2019-10407

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Project Inheritance Plugin versions 2.0.0 and earlier Jenkins Project Inheritance Plugin versions 19.08.02 and earlier

Description The issue concerns the display of environment variables passed to a build without properly masking sensitive information. This is specifically related to variables contributed by the Mask Passwords Plugin.

Recommendations For versions 2.0.0 and earlier, update to a version that properly masks sensitive environment variables. For versions 19.08.02 and earlier, update to a version that properly masks sensitive environment variables. As a temporary workaround, consider restricting access to the build environment variables to minimize the risk of sensitive information exposure.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2019-10407

GHSA-XJ4W-R6GR-X5QM

Affected Products

Jenkins

Jenkins Project Inheritance Plugin

Mask Passwords Plugin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-10407 · Security Note
• https://jenkins.io/security/advisory/2019-09-25/#SECURITY-351 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xj4w-r6gr-x5qm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10407 · Vendor Advisory
• http://openwall.com/lists/oss-security/2019/09/25/3 · Note