Jenkins Reverse Proxy Auth Plugin allows attackers with local file system access to obtain a list of authorities for logged in users

LOW 3.3CVE-2018-1000150 · GHSA-m9j2-grqf-fg26 · Published 05/04/2018 · updated 17/06/2026

In short

CVE-2018-1000150 is a LOW (CVSS 3.3) vulnerability affecting org.jenkins-ci.plugins:reverse-proxy-auth-plugin, reverse proxy auth (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.34%, higher than 27.9% of all vulnerabilities.
Fix: update to 1.6.0 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:reverse-proxy-auth-plugin Maven	`< 1.6.0`	`1.6.0`
reverse proxy auth jenkins	`≤ 1.5`	No fix yet

Description

An exposure of sensitive information vulnerability exists in Jenkins Reverse Proxy Auth Plugin 1.5 and older in ReverseProxySecurityRealm#authContext that allows attackers with local file system access to obtain a list of authorities for logged in users. Reverse Proxy Auth Plugin 1.6.0 and newer no longer store the cache of granted authorities on disk.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2018-1000150 · ADVISORY
jenkinsci/reverse-proxy-auth-plugin · PACKAGE
jenkins.io/security/advisory/2018-03-26 · WEB

More vulnerabilities in org.jenkins-ci.plugins:reverse-proxy-auth-plugin

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:reverse-proxy-auth-plugin

Maven

< 1.6.0

1.6.0

reverse proxy auth

jenkins

≤ 1.5

No fix yet

Description

NVD description