Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS01cjZwLXA5cjYtcjMyNs4AAhfs

Improper Encoding or Escaping of Output in Jenkins Configuration as Code Plugin

Jenkins Configuration as Code Plugin 1.24 and earlier did not escape values resulting in variable interpolation during configuration import when exporting, allowing attackers with permission to change Jenkins system configuration to obtain the values of environment variables.

Permalink: https://github.com/advisories/GHSA-5r6p-p9r6-r326
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01cjZwLXA5cjYtcjMyNs4AAhfs
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: 4 months ago

CVSS Score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Identifiers: GHSA-5r6p-p9r6-r326, CVE-2019-10362
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-10362
• https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1446
• http://www.openwall.com/lists/oss-security/2019/07/31/1
• https://github.com/jenkinsci/configuration-as-code-plugin/commit/b48a292112c532ab1447b864c7d30c2cae733ac8
• https://github.com/advisories/GHSA-5r6p-p9r6-r326

Repository: https://github.com/jenkinsci/configuration-as-code-plugin
Blast Radius: 1.0

Affected Packages