CVE-2019-10407 Project Inheritance Plugin showed secret environment variables defined in Mask Passwords Plugin
Attackers can view sensitive environment variables in build logs because the plugin fails to mask them, exposing secrets to unauthorized users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10407?
CVE-2019-10407 is a medium-severity vulnerability in Jenkins Project Inheritance Plugin, published on 25 Sep 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Jenkins Project Inheritance Plugin 2.0.0 and earlier displayed a list of environment variables passed to a build without masking sensitive variables contributed by the Mask Passwords Plugin.
Weakness: CWE-200
Which versions are affected by CVE-2019-10407?
2 open source packages ship an affected version, including hudson.plugins:project-inheritance. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
hudson.plugins:project-inheritance Maven | All versions | 19.08.02 |
hudson.plugins:project-inheritance Maven | All versions | 19.08.02 |
Products include Jenkins Project Inheritance.
How do I fix CVE-2019-10407?
Upgrade hudson.plugins:project-inheritance to 19.08.02 or later.
Is CVE-2019-10407 being exploited?
There is no known exploitation of CVE-2019-10407 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Project Inheritance Plugin
- CVE-2020-2198 Missing permission check in Jenkins Project Inheritance Plugin
- CVE-2022-34787 Jenkins Project Inheritance Plugin vulnerable to cross site scripting
- CVE-2020-2197 Missing permission check in Jenkins Project Inheritance Plugin
- CVE-2019-10408 Jenkins Project Inheritance Plugin vulnerable to Cross-Site Request Forgery
- CVE-2019-10409 Missing permission check in Jenkins Project Inheritance Plugin
Sources
Also known as GHSA-xj4w-r6gr-x5qm.