Configuration As Code (Jenkins) - vulnerabilities (CVEs)
9 CVEs, 0 in the last 30 days, 73 known versions, newest CVE from 2022-01-12. Vendor: Jenkins.
CVEs of Configuration As Code
- CVE-2022-23106 - CVSS 5.3 (medium), 2022-01-12: Jenkins Configuration as Code Plugin 1.55 and earlier used a non-constant time comparison function when validating an authentication token allowing attackers…
- CVE-2019-10367 - CVSS 5.5 (medium), 2019-08-07: Due to an incomplete fix of CVE-2019-10343, Jenkins Configuration as Code Plugin 1.26 and earlier did not properly apply masking to some values expected to be…
- CVE-2019-10362 - CVSS 5.4 (medium), 2019-07-31: Jenkins Configuration as Code Plugin 1.24 and earlier did not escape values resulting in variable interpolation during configuration import when exporting,…
- CVE-2019-10345 - CVSS 5.5 (medium), 2019-07-31: Jenkins Configuration as Code Plugin 1.20 and earlier did not treat the proxy password as a secret to be masked when logging or encrypted for export.
- CVE-2019-10344 - CVSS 4.3 (medium), 2019-07-31: Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with Overall/Read access to access…
- CVE-2019-10363 - CVSS 4.9 (medium), 2019-07-31: Jenkins Configuration as Code Plugin 1.24 and earlier did not reliably identify sensitive values expected to be exported in their encrypted form.
- CVE-2019-10343 - CVSS 3.3 (low), 2019-07-31: Jenkins Configuration as Code Plugin 1.24 and earlier did not properly apply masking to values expected to be hidden when logging the configuration being…
- CVE-2018-1000610 - CVSS 8.8 (high), 2018-06-26: A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in DataBoundConfigurator.java,…
- CVE-2018-1000609 - CVSS 6.5 (medium), 2018-06-26: A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in ConfigurationAsCode.java that allows…
