Description
An exposure of sensitive information vulnerability exists in Jenkins Reverse Proxy Auth Plugin 1.5 and older in ReverseProxySecurityRealm#authContext that allows attackers with local file system access to obtain a list of authorities for logged in users.
Remediation
References
https://jenkins.io/security/advisory/2018-03-26/#SECURITY-736
Related Vulnerabilities
CVE-2015-7499 Vulnerability in npm package libxmljs
CVE-2019-10389 Vulnerability in maven package org.jenkins-ci.plugins:relution-publisher
CVE-2022-25883 Vulnerability in maven package org.webjars.npm:semver
CVE-2022-43435 Vulnerability in maven package org.jenkins-ci.plugins.plugin:fireline
CVE-2016-0706 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core