Project Inheritance Plugin showed secret environment variables defined in Mask Passwords Plugin

MEDIUM 6.5CVE-2019-10407 · GHSA-xj4w-r6gr-x5qm · Published 25/09/2019 · updated 17/06/2026

In short

CVE-2019-10407 is a MEDIUM (CVSS 6.5) vulnerability affecting hudson.plugins:project-inheritance, project inheritance (jenkins).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 67.9% of all vulnerabilities.
Fix: update to 19.08.02 or later.

Package	Affected versions	Patched versions
hudson.plugins:project-inheritance Maven	`< 19.08.02`	`19.08.02`
project inheritance jenkins	`≤ 2.0.0`	No fix yet

Description

Jenkins Project Inheritance Plugin 19.08.02 and earlier displayed a list of environment variables passed to a build without masking sensitive variables contributed by the Mask Passwords Plugin.

NVD description

Jenkins Project Inheritance Plugin 2.0.0 and earlier displayed a list of environment variables passed to a build without masking sensitive variables contributed by the Mask Passwords Plugin.

References

nvd.nist.gov/vuln/detail/CVE-2019-10407 · ADVISORY
jenkins.io/security/advisory/2019-09-25 · WEB
openwall.com/lists/oss-security/2019/09/25/3 · WEB

More vulnerabilities in hudson.plugins:project-inheritance

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

hudson.plugins:project-inheritance

Maven

< 19.08.02

19.08.02

project inheritance

jenkins

≤ 2.0.0

No fix yet

Description

Jenkins Project Inheritance Plugin 19.08.02 and earlier displayed a list of environment variables passed to a build without masking sensitive variables contributed by the Mask Passwords Plugin.

NVD description

Jenkins Project Inheritance Plugin 2.0.0 and earlier displayed a list of environment variables passed to a build without masking sensitive variables contributed by the Mask Passwords Plugin.

More vulnerabilities in hudson.plugins:project-inheritance

See all →