Exposure of Sensitive Environment Variables in Jenkins Project Inheritance Plugin

CVE-2019-10407

What is CVE-2019-10407?

The Project Inheritance Plugin for Jenkins versions 2.0.0 and earlier is susceptible to an information exposure issue. This vulnerability can result in sensitive environment variables being displayed during build processes, as these variables are not adequately masked. The risk arises particularly when the Mask Passwords Plugin is utilized, which aims to protect sensitive data but fails in this scenario. Therefore, attackers could potentially gain access to confidential information that is passed to builds, undermining the security of the Jenkins environment.

References