PT-2019-11830 · Jenkins · Jenkins Google Oauth Credentials Plugin+1

Daniel Beck + 2 · Publicado 2019-10-16 · Atualizado 2023-10-25 · CVE-2019-10436

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Google OAuth Credentials Plugin version 0.9 and earlier

Description The issue allows attackers who can configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master due to an arbitrary file read vulnerability.

Recommendations For Jenkins Google OAuth Credentials Plugin version 0.9 and earlier, update to a version later than 0.9 to resolve the issue.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-10436

GHSA-8QH4-FGHR-6FXG

Produtos afetados

Jenkins

Jenkins Google Oauth Credentials Plugin

Referências · 6

• https://github.com/jenkinsci/google-oauth-plugin/commit/aef26a8425e515a9986412000d6191db95fa9e56 · Nota
• https://github.com/jenkinsci/google-oauth-plugin · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10436 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-10436 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-8qh4-fghr-6fxg · Aviso do Fabricante
• https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1583 · Aviso do Fabricante