PT-2018-9322 · Jenkins · Jenkins Reverse Proxy Auth Plugin+1

Oleg Nenashev · Publicado 2018-04-05 · Atualizado 2022-05-14 · CVE-2018-1000150

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Reverse Proxy Auth Plugin versions 1.5 and older

Description An exposure of sensitive information issue exists in the ReverseProxySecurityRealm#authContext that allows attackers with local file system access to obtain a list of authorities for logged in users. This occurs because the cache of granted authorities is stored on disk, which can be accessed by attackers.

Recommendations For Jenkins Reverse Proxy Auth Plugin versions 1.5 and older, update to version 1.6.0 or newer, as these versions no longer store the cache of granted authorities on disk.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-1000150

GHSA-M9J2-GRQF-FG26

Produtos afetados

Jenkins

Jenkins Reverse Proxy Auth Plugin

Referências · 5

• https://github.com/jenkinsci/reverse-proxy-auth-plugin · Nota
• https://jenkins.io/security/advisory/2018-03-26/#SECURITY-736 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000150 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-m9j2-grqf-fg26 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1000150 · Aviso do Fabricante