Description

An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master.

Remediation

References

https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1583

Related Vulnerabilities

CVE-2023-34981 Vulnerability in maven package org.apache.tomcat:tomcat-coyote

CVE-2023-50771 Vulnerability in maven package org.jenkins-ci.plugins:oic-auth

CVE-2022-34187 Vulnerability in maven package aendter.jenkins.plugins:filesystem-list-parameter-plugin

CVE-2023-30531 Vulnerability in maven package org.jenkins-ci.plugins:consul-kv-builder

CVE-2016-3674 Vulnerability in maven package org.jbehave:jbehave-core

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Vendor Advisory NVD-CWE-Other