CVE-2019-10344: Missing Authorization in Jenkins Configuration as Code Plugin
Summary
CVE-2019-10344: Missing Authorization in Jenkins Configuration as Code Plugin. Affects io.jenkins:configuration-as-code versions < 1.25. Fixed in 1.25. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins Configuration as Code Plugin is a Maven package (io.jenkins:configuration-as-code) that allows users to define Jenkins configuration in a human-readable format. It provides a convenient way to manage and version control Jenkins configuration. This plugin is widely used in Jenkins deployments to simplify the configuration process and ensure consistency across different environments.
Vulnerability Detail
The Jenkins Configuration as Code Plugin version 1.24 and earlier suffer from a missing authorization vulnerability. This vulnerability allows users with Overall/Read access to access the generated schema and documentation for the plugin. The schema and documentation contain detailed information about installed plugins, which can be valuable for an attacker to gather information about the Jenkins environment. The lack of proper permission checks in various HTTP endpoints exposes this sensitive information to unauthorized users.
How To Fix
Minimum fixed version
1.25
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the affected HTTP endpoints by modifying the Jenkins configuration or using access control plugins. This can be achieved by configuring appropriate permissions for the Overall/Read access level. However, applying the workaround may limit the functionality of the plugin and is not a permanent solution. It is strongly advised to upgrade to the latest version of the plugin as soon as possible.
Conclusion
The missing authorization vulnerability in Jenkins Configuration as Code Plugin can potentially expose sensitive information about installed plugins to unauthorized users. It is crucial to upgrade to the latest version of the plugin (1.25 or later) to mitigate this vulnerability. Applying the recommended fix or workaround helps ensure that only authorized users can access the generated schema and documentation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.jenkins:configuration-as-code →
FAQ
This vulnerability allows unauthorized users with Overall/Read access to gather detailed information about installed plugins in the Jenkins environment. This information can be used by attackers to identify potential vulnerabilities or weaknesses in the Jenkins deployment.
Users of Jenkins Configuration as Code Plugin versions 1.24 and earlier are affected by this vulnerability. Specifically, users with Overall/Read access are at risk of unauthorized access to the generated schema and documentation.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to apply the recommended fix or workaround to mitigate the risk of unauthorized access.
Yes, this vulnerability can be exploited remotely by sending HTTP requests to the affected endpoints. However, the attacker needs to have Overall/Read access to the Jenkins instance to successfully exploit the vulnerability.
Yes, the CVSS score for this vulnerability is 4.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.jenkins:configuration-as-code.
