CVE-2019-10362

Опубликовано: 31 июл. 2019

Источник: nvd

CVSS3: 5.4

CVSS2: 5.5

EPSS Низкий

Описание

Jenkins Configuration as Code Plugin 1.24 and earlier did not escape values resulting in variable interpolation during configuration import when exporting, allowing attackers with permission to change Jenkins system configuration to obtain the values of environment variables.

Ссылки

http://www.openwall.com/lists/oss-security/2019/07/31/1
Mailing List
Third Party Advisory
https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1446
Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/07/31/1
Mailing List
Third Party Advisory
https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1446
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jenkins:configuration_as_code:*:*:*:*:*:jenkins:*:*

Версия до 1.24 (включая)

EPSS

Процентиль: 31%

0.00119

Низкий

5.4 Medium

CVSS3

5.5 Medium

CVSS2

Дефекты

CWE-116

Связанные уязвимости

GHSA-5r6p-p9r6-r326