CVE-2018-1000609

MEDIUM

Jenkins Configuration as Code Plugin <0.7-alpha - Info Disclosure

Title source: llm

Description

A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in ConfigurationAsCode.java that allows attackers with Overall/Read access to obtain the YAML export of the Jenkins configuration.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://jenkins.io/security/advisory/2018-06-25/#SECURITY-927

Scores

CVSS v3 6.5

EPSS 0.0007

EPSS Percentile 21.0%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-200

Status published

Products (8)

io.jenkins/configuration-as-code 0 - 0.8-alphaMaven

jenkins/configuration_as_code 0.1 alpha

jenkins/configuration_as_code 0.2 alpha

jenkins/configuration_as_code 0.3 alpha

jenkins/configuration_as_code 0.4 alpha

jenkins/configuration_as_code 0.5 alpha

jenkins/configuration_as_code 0.6 alpha

jenkins/configuration_as_code 0.7 alpha

Published Jun 26, 2018

Tracked Since Feb 18, 2026