CVE-2019-10362 Improper Encoding or Escaping of Output in Jenkins Configuration as Code Plugin

Medium 5.4 Published 31 Jul 2019 Updated 4 Aug 2024

Attackers with system configuration permissions can read environment variables due to improper escaping during configuration export.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-10362?

CVE-2019-10362 is a medium-severity vulnerability in Jenkins Configuration as Code Plugin, published on 31 Jul 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Jenkins Configuration as Code Plugin 1.24 and earlier did not escape values resulting in variable interpolation during configuration import when exporting, allowing attackers with permission to change Jenkins system configuration to obtain the values of environment variables.

Weakness: CWE-116

Which versions are affected by CVE-2019-10362?

2 open source packages ship an affected version, including io.jenkins:configuration-as-code. It affects 1 product.

Package	Affected	Fixed in
`io.jenkins:configuration-as-code` Maven	All versions	`1.25`
`io.jenkins:configuration-as-code` Maven	All versions	`1.25`

Products include Jenkins Configuration as Code.

How do I fix CVE-2019-10362?

Upgrade io.jenkins:configuration-as-code to 1.25 or later.

Is CVE-2019-10362 being exploited?

There is no known exploitation of CVE-2019-10362 in the wild and no public exploit code.

Sources

Also known as GHSA-5r6p-p9r6-r326.