« Volver al listado

CVE-2018-1000610

Estado: ModificadaAlta (8.8)—

A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in DataBoundConfigurator.java, Attribute.java, BaseConfigurator.java, ExtensionConfigurator.java that allows attackers with access to Jenkins log files to obtain the passwords configured using Configuration as Code Plugin.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Jenkins — Configuration AS Code

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-1000610",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-06-26T17:29:00.710",
  "references": [
    {
      "url": "https://jenkins.io/security/advisory/2018-06-25/#SECURITY-929",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://jenkins.io/security/advisory/2018-06-25/#SECURITY-929",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in DataBoundConfigurator.java, Attribute.java, BaseConfigurator.java, ExtensionConfigurator.java that allows attackers with access to Jenkins log files to obtain the passwords configured using Configuration as Code Plugin."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de exposición de información sensible en el plugin de Jenkins Configuration as Code en versiones 0.7-alpha y anteriores en DataBoundConfigurator.java, Attribute.java, BaseConfigurator.java y ExtensionConfigurator.java que permite que los atacantes con acceso a los archivos de log de Jenkins obtengan las contraseñas configuradas utilizando el plugin Configuration as Code."
    }
  ],
  "lastModified": "2026-06-17T01:32:56.040",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jenkins:configuration_as_code:0.1:alpha:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "97F6937C-8891-4EC7-A1D5-AF34F8DAA87E"
            },
            {
              "criteria": "cpe:2.3:a:jenkins:configuration_as_code:0.2:alpha:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7BC65D8E-3D66-42A9-BA42-F33E66B7A38A"
            },
            {
              "criteria": "cpe:2.3:a:jenkins:configuration_as_code:0.3:alpha:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "72B796C8-084B-459F-A993-198B236BC196"
            },
            {
              "criteria": "cpe:2.3:a:jenkins:configuration_as_code:0.4:alpha:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E46C68E2-CF0F-4F0B-9213-DD9CEAE469EA"
            },
            {
              "criteria": "cpe:2.3:a:jenkins:configuration_as_code:0.5:alpha:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AC4D7ECE-8F3B-45E3-B548-FFF05942EA6E"
            },
            {
              "criteria": "cpe:2.3:a:jenkins:configuration_as_code:0.6:alpha:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B116A273-E885-4BFD-82CE-D70F5B38FC4C"
            },
            {
              "criteria": "cpe:2.3:a:jenkins:configuration_as_code:0.7:alpha:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6425A883-BCCF-49EA-85D1-56CD915C2F00"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}