~ / search / GHSA-3858-58w9-wpcg

GHSA-3858-58w9-wpcg

Jenkins OpenId Connect Authentication Plugin showed plain text client secret in configuration form

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-1003021

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:oic-auth < 1.5 1.5

Details

As written in the advisory (Markdown source, shown as plain text).

An exposure of sensitive information vulnerability exists in Jenkins OpenId Connect Authentication Plugin 1.4 and earlier in OicSecurityRealm/config.jelly that allows attackers able to view a Jenkins administrator's web browser output, or control the browser (e.g. malicious extension) to retrieve the configured client secret.

References

External links from the advisory. They lead to third-party sites.