Information Exposure Affecting io.jenkins:configuration-as-code package, versions [,0.8-alpha)


0.0
medium

Snyk CVSS

    Attack Complexity Low
    Confidentiality High

    Threat Intelligence

    EPSS 0.06% (25th percentile)
Expand this section
NVD
6.5 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-IOJENKINS-32395
  • published 1 Jul 2018
  • disclosed 25 Jun 2018
  • credit Unknown

How to fix?

Upgrade io.jenkins:configuration-as-code to version 0.8-alpha or higher.

Overview

io.jenkins:configuration-as-code has been designed as an opinionated way to configure jenkins based on human-readable declarative configuration files.

Affected versions of this package are vulnerable to Information Exposure via the ConfigurationAsCode.java method. An attacker with Overall/Read access could obtain the YAML export of the Jenkins configuration.