Cleartext Transmission of Sensitive Information in Jenkins Configuration as Code Plugin

MEDIO 4.9CVE-2019-10363 · GHSA-r69h-6c4g-63xf · Published 31/07/2019 · updated 17/06/2026

En resumen

CVE-2019-10363 es una vulnerabilidad MEDIO (CVSS 4.9) que afecta a io.jenkins:configuration-as-code, configuration as code (jenkins).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.61%, mayor que el 49.2% de las vulnerabilidades.
Solución: actualizar a 1.25 o posterior.

Package	Affected versions	Patched versions
io.jenkins:configuration-as-code Maven	`< 1.25`	`1.25`
configuration as code jenkins	`≤ 1.24`	No fix yet

Jenkins Configuration as Code Plugin 1.24 and earlier did not reliably identify sensitive values expected to be exported in their encrypted form.

NVD description

Jenkins Configuration as Code Plugin 1.24 and earlier did not reliably identify sensitive values expected to be exported in their encrypted form.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Maven

< 1.25

1.25

≤ 1.24

No fix yet

Description

Jenkins Configuration as Code Plugin 1.24 and earlier did not reliably identify sensitive values expected to be exported in their encrypted form.

NVD description

Jenkins Configuration as Code Plugin 1.24 and earlier did not reliably identify sensitive values expected to be exported in their encrypted form.

Más vulnerabilidades de io.jenkins:configuration-as-code

Ver todo →