CVE-2019-1003018

2022-10-0316:19:42

jenkins

www.cve.org

jenkins

github

authentication plugin

vulnerability

sensitive information

4.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.5%

JSON

An exposure of sensitive information vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm/config.jelly that allows attackers able to view a Jenkins administrator’s web browser output, or control the browser (e.g. malicious extension) to retrieve the configured client secret.

CNA Affected

[
  {
    "product": "Jenkins GitHub Authentication Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "status": "affected",
        "version": "0.29 and earlier"
      }
    ]
  }
]

References

jenkins.io/security/advisory/2019-01-28/#SECURITY-602