GitHub Advisoryadvisory · Maven

GHSA-5r6p-p9r6-r326 Improper Encoding or Escaping of Output in Jenkins Configuration as Code Plugin

MEDIUM Published 2022-05-24 Modified 2022-06-28 Official page ↗
Aliases
CVE-2019-10362
Ecosystem
Maven
Packages
io.jenkins:configuration-as-code
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-116
Reviewed
2022-06-28

Affected packages

• Maven io.jenkins:configuration-as-code: < 1.25 → fixed in 1.25

Description

Jenkins Configuration as Code Plugin 1.24 and earlier did not escape values resulting in variable interpolation during configuration import when exporting, allowing attackers with permission to change Jenkins system configuration to obtain the values of environment variables.

Related

Alias · CVE (1)

  • CVE-2019-10362 Jenkins Configuration as Code Plugin 1.24 and earlier did not escape values resulting in variable interpolation during configuration import… vulnerability

Weakness · CWE (1)

  • CWE-116 Improper Encoding or Escaping of Output weakness

References