Configuration AS Code vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

CA

Product

Configuration AS Code

by Jenkins · last CVE Jan 12, 2022

9

CVEs

0

On KEV

8.8

Max CVSS

0

New 30D

Vulnerabilities9 In the news0 Timeline

Severity mix

Critical 0High 1Medium 7Low 1

Severity

All severities9 Critical0 High1 Medium7 Low1

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Configuration AS Code to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2018-1000610	8.8	1%	Jun 26	A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in DataBoundConfigurator.java, Attribute.java,… Affected: 0.1; 0.2; 0.3; 0.4; 0.5; 0.6; +1 more
CVE-2018-1000609	6.5	1%	Jun 26	A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in ConfigurationAsCode.java that allows attackers with… Affected: 0.1; 0.2; 0.3; 0.4; 0.5; 0.6; +1 more
CVE-2019-10367	5.5	0%	Aug 7	Due to an incomplete fix of CVE-2019-10343, Jenkins Configuration as Code Plugin 1.26 and earlier did not properly apply masking to some values expected to be hidden when logging… Affected: through 1.26
CVE-2019-10345	5.5	0%	Jul 31	Jenkins Configuration as Code Plugin 1.20 and earlier did not treat the proxy password as a secret to be masked when logging or encrypted for export Affected: before 1.20
CVE-2019-10362	5.4	1%	Jul 31	Jenkins Configuration as Code Plugin 1.24 and earlier did not escape values resulting in variable interpolation during configuration import when exporting, allowing attackers with… Affected: through 1.24
CVE-2022-23106	5.3	1%	Jan 12	Jenkins Configuration as Code Plugin 1.55 and earlier used a non-constant time comparison function when validating an authentication token allowing attackers to use statistical… Affected: through 1.55
CVE-2019-10363	4.9	1%	Jul 31	Jenkins Configuration as Code Plugin 1.24 and earlier did not reliably identify sensitive values expected to be exported in their encrypted form Affected: through 1.24
CVE-2019-10344	4.3	1%	Jul 31	Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with Overall/Read access to access the generated schema… Affected: through 1.24
CVE-2019-10343	3.3	0%	Jul 31	Jenkins Configuration as Code Plugin 1.24 and earlier did not properly apply masking to values expected to be hidden when logging the configuration being applied Affected: through 1.24