GitHub Advisoryadvisory · Maven

GHSA-r69h-6c4g-63xf Cleartext Transmission of Sensitive Information in Jenkins Configuration as Code Plugin

MEDIUM Published 2022-05-24 Modified 2022-06-28 Official page ↗

Aliases: CVE-2019-10363
Ecosystem: Maven
Packages: io.jenkins:configuration-as-code
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-311, CWE-319
Reviewed: 2022-06-28

Affected packages

• Maven io.jenkins:configuration-as-code: < 1.25 → fixed in 1.25

Description

Jenkins Configuration as Code Plugin 1.24 and earlier did not reliably identify sensitive values expected to be exported in their encrypted form.

Related

Alias · CVE (1)

CVE-2019-10363 Jenkins Configuration as Code Plugin 1.24 and earlier did not reliably identify sensitive values expected to be exported in their encrypted… vulnerability

Weakness · CWE (2)

CWE-311 Missing Encryption of Sensitive Data weakness
CWE-319 Cleartext Transmission of Sensitive Information weakness

References