Description

Jenkins WSO2 Oauth Plugin 1.0 and earlier does not mask the WSO2 Oauth client secret on the global configuration form, increasing the potential for attackers to observe and capture it.

Remediation

References

https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2992

http://www.openwall.com/lists/oss-security/2023/04/13/3

Related Vulnerabilities

CVE-2021-21692 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2022-22969 Vulnerability in maven package org.springframework.security.oauth:spring-security-oauth

CVE-2022-36907 Vulnerability in maven package org.jenkins-ci.plugins:openshift-deployer

CVE-2017-12624 Vulnerability in maven package org.apache.cxf:cxf-core

CVE-2021-43801 Vulnerability in npm package mercurius

Severity

High

Classification

CWE-312 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Vendor Advisory Mailing List Third Party Advisory