CVE-2019-1003021

CWE-200 — Information Exposure5 documents5 sources

Severity

4.3MEDIUM

EPSS

0.0%

top 88.52%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Jenkins Openid Connect Authentication Jenkins Project Jenkins Openid Connect Authentication Plugin

Timeline

PublishedFeb 6

Latest updateMay 13

Description

An exposure of sensitive information vulnerability exists in Jenkins OpenId Connect Authentication Plugin 1.4 and earlier in OicSecurityRealm/config.jelly that allows attackers able to view a Jenkins administrator's web browser output, or control the browser (e.g. malicious extension) to retrieve the configured client secret.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5jenkins_project/jenkins_openid_connect_authentication_plugin1.4 and earlier

▶NVDjenkins/openid_connect_authentication1.4

▶Mavenorg.jenkins-ci.plugins:oic-auth< 1.5

🔴Vulnerability Details

GHSA

Jenkins OpenId Connect Authentication Plugin showed plain text client secret in configuration form↗2022-05-13

▶

OSV

Jenkins OpenId Connect Authentication Plugin showed plain text client secret in configuration form↗2022-05-13

▶

CVEList

CVE-2019-1003021: An exposure of sensitive information vulnerability exists in Jenkins OpenId Connect Authentication Plugin 1↗2019-02-06

▶

📋Vendor Advisories

Jenkins

Jenkins Security Advisory 2019-01-28↗2019-01-28

▶