CVE-2019-10344: Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoint...

Security readout for executives and security teams

Authenticated Jenkins users with only Overall/Read access could view Configuration as Code plugin schema and documentation that exposed detailed information about installed plugins. This is mainly an information-disclosure issue: it may help attackers map the Jenkins environment, but the supplied sources do not show direct code execution or privilege escalation. Exposure is limited to Jenkins instances using Configuration as Code Plugin 1.24 or earlier, where untrusted or broadly provisioned users have Overall/Read access. Treat as a controlled but real exposure issue. Prioritize Jenkins environments with many low-privilege users, external access, or sensitive plugin inventories. Mitigation focus: Check Jenkins advisory SECURITY-1290 for the corrected plugin guidance.; Update Jenkins Configuration as Code Plugin if running version 1.24 or earlier.; Restrict Overall/Read access to trusted users with a business need..

Prepared

Jun 6, 2026, 14:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.