Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2019-10362

Jenkins Configuration as Code Plugin 1.24 and earlier did not escape values resulting in variable interpolation during configuration import when exporting, allowing attackers with

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
jenkins

Description

Jenkins Configuration as Code Plugin 1.24 and earlier did not escape values resulting in variable interpolation during configuration import when exporting, allowing attackers with permission to change Jenkins system configuration to obtain the values of environment variables.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Jenkins project Jenkins Configuration as Code Plugin

  • 1.24 and earlieraffected

References