Login Request a demo
Medium severity · published Jul 31, 2019
CVE-2019-10362
Jenkins Configuration as Code Plugin 1.24 and earlier did not escape values resulting in variable interpolation during configuration import when exporting, allowing attackers with…
5.4
CVSS
0.7%
EPSS
No
On KEV
Description
Jenkins Configuration as Code Plugin 1.24 and earlier did not escape values resulting in variable interpolation during configuration import when exporting, allowing attackers with permission to change Jenkins system configuration to obtain the values of environment variables.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Configuration AS Code · Jenkins
through 1.24 · source: NVD
Affected product
CA
Configuration AS Code
Jenkins
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-10362
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-10362
Mailing List
http://www.openwall.com/lists/oss-security/2019/07/31/1
Vendor Advisory
https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1446
More from Configuration AS Code
8.8
CVE-2018-1000610
A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in DataBoundConfigurator.java, Attribute.java,…
6.5
CVE-2018-1000609
A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in ConfigurationAsCode.java that allows attackers with…
5.5
CVE-2019-10367
Due to an incomplete fix of CVE-2019-10343, Jenkins Configuration as Code Plugin 1.26 and earlier did not properly apply masking to some values expected to be hidden when logging…
5.5
CVE-2019-10345
Jenkins Configuration as Code Plugin 1.20 and earlier did not treat the proxy password as a secret to be masked when logging or encrypted for export
5.3
CVE-2022-23106
Jenkins Configuration as Code Plugin 1.55 and earlier used a non-constant time comparison function when validating an authentication token allowing attackers to use statistical…