« Volver al listado

CVE-2018-1000609

Estado: ModificadaMedia (6.5)—

A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in ConfigurationAsCode.java that allows attackers with Overall/Read access to obtain the YAML export of the Jenkins configuration.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Jenkins — Configuration AS Code

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-1000609",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-06-26T17:29:00.663",
  "references": [
    {
      "url": "https://jenkins.io/security/advisory/2018-06-25/#SECURITY-927",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://jenkins.io/security/advisory/2018-06-25/#SECURITY-927",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in ConfigurationAsCode.java that allows attackers with Overall/Read access to obtain the YAML export of the Jenkins configuration."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de exposición de información sensible en el plugin de Jenkins Configuration as Code en versiones 0.7-alpha y anteriores en ConfigurationAsCode.java que permite que los atacantes con acceso Overall/Read obtengan el export YAML de la configuración de Jenkins."
    }
  ],
  "lastModified": "2026-06-17T01:32:55.917",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jenkins:configuration_as_code:0.1:alpha:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "97F6937C-8891-4EC7-A1D5-AF34F8DAA87E"
            },
            {
              "criteria": "cpe:2.3:a:jenkins:configuration_as_code:0.2:alpha:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7BC65D8E-3D66-42A9-BA42-F33E66B7A38A"
            },
            {
              "criteria": "cpe:2.3:a:jenkins:configuration_as_code:0.3:alpha:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "72B796C8-084B-459F-A993-198B236BC196"
            },
            {
              "criteria": "cpe:2.3:a:jenkins:configuration_as_code:0.4:alpha:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E46C68E2-CF0F-4F0B-9213-DD9CEAE469EA"
            },
            {
              "criteria": "cpe:2.3:a:jenkins:configuration_as_code:0.5:alpha:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AC4D7ECE-8F3B-45E3-B548-FFF05942EA6E"
            },
            {
              "criteria": "cpe:2.3:a:jenkins:configuration_as_code:0.6:alpha:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B116A273-E885-4BFD-82CE-D70F5B38FC4C"
            },
            {
              "criteria": "cpe:2.3:a:jenkins:configuration_as_code:0.7:alpha:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6425A883-BCCF-49EA-85D1-56CD915C2F00"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}