Miggo Logo
Miggo Vulnerability Database
→
CVE-2019-10344

CVE-2019-10344: Missing Authorization in Jenkins Configuration as Code Plugin

4.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2019-10344
GHSA ID
GHSA-mqr8-3v8j-46wv
EPSS Score
0.07093%
CWE
CWE-285
Published
5/24/2022
Updated
12/6/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
io.jenkins:configuration-as-codemaven<= 1.241.25

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The commit 1c531c1 explicitly added Administer permission checks to both doReference() and doSchema() methods. Prior to this fix, these endpoints were accessible to users with just Overall/Read permissions as shown in the Security1290Test.java verification. The vulnerability description specifically mentions unauthorized access to schema and documentation endpoints, which directly corresponds to these two handler methods.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Missin* p*rmission ****ks in J*nkins *on*i*ur*tion *s *o** Plu*in *.** *n* **rli*r in v*rious *TTP *n*points *llow** us*rs wit* Ov*r*ll/R*** ****ss to ****ss t** **n*r*t** s***m* *n* *o*um*nt*tion *or t*is plu*in *ont*inin* **t*il** in*orm*tion **out

Reasoning

T** *ommit ******* *xpli*itly ***** **minist*r p*rmission ****ks to *ot* `*oR***r*n**()` *n* `*oS***m*()` m*t*o*s. Prior to t*is *ix, t**s* *n*points w*r* ****ssi*l* to us*rs wit* just Ov*r*ll/R*** p*rmissions *s s*own in t** `S**urity****T*st.j*v*`