~ / search / GHSA-6r5w-jjr5-qvgr

GHSA-6r5w-jjr5-qvgr

Password stored in a recoverable format by Jenkins OpenId Connect Authentication Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-50770

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:oic-auth < 4.229.vf736b 4.229.vf736b

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins OpenId Connect Authentication Plugin stores a password of a local user account used as an anti-lockout feature in a recoverable format, allowing attackers with access to the Jenkins controller file system to recover the plain text password of that account, likely gaining administrator access to Jenkins.

References

External links from the advisory. They lead to third-party sites.