Description

An exposure of sensitive information vulnerability exists in Jenkins Reverse Proxy Auth Plugin 1.5 and older in ReverseProxySecurityRealm#authContext that allows attackers with local file system access to obtain a list of authorities for logged in users.

Remediation

References

https://jenkins.io/security/advisory/2018-03-26/#SECURITY-736

Related Vulnerabilities

CVE-2019-10308 Vulnerability in maven package org.jvnet.hudson.plugins:analysis-core

CVE-2023-31098 Vulnerability in maven package org.apache.inlong:manager-pojo

CVE-2021-32012 Vulnerability in npm package xlsx

CVE-2023-24435 Vulnerability in maven package org.jenkins-ci.plugins:ghprb

CVE-2023-45819 Vulnerability in npm package tinymce

Severity

Low

Classification

CWE-200 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Vendor Advisory