Em resumo
- CVE-2019-1003021 é uma vulnerabilidade MÉDIO (CVSS 4.3) que afeta org.jenkins-ci.plugins:oic-auth, openid connect authentication (jenkins).
- Chance de exploração nos próximos 30 dias (EPSS): 1.1%, maior que 66.5% das vulnerabilidades.
- Correção: atualize para 1.5 ou posterior.
Description
An exposure of sensitive information vulnerability exists in Jenkins OpenId Connect Authentication Plugin 1.4 and earlier in OicSecurityRealm/config.jelly that allows attackers able to view a Jenkins administrator's web browser output, or control the browser (e.g. malicious extension) to retrieve the configured client secret.
NVD description
An exposure of sensitive information vulnerability exists in Jenkins OpenId Connect Authentication Plugin 1.4 and earlier in OicSecurityRealm/config.jelly that allows attackers able to view a Jenkins administrator's web browser output, or control the browser (e.g. malicious extension) to retrieve the configured client secret.
Mais vulnerabilidades de org.jenkins-ci.plugins:oic-auth
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free