CVE-2018-1000150 Jenkins Reverse Proxy Auth Plugin allows attackers with local file system access to obtain a list of authorities for logged in users

What is CVE-2018-1000150?

CVE-2018-1000150 is a low-severity vulnerability in n/a, published on 5 Apr 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An exposure of sensitive information vulnerability exists in Jenkins Reverse Proxy Auth Plugin 1.5 and older in ReverseProxySecurityRealm#authContext that allows attackers with local file system access to obtain a list of authorities for logged in users.

Weakness: CWE-200

Which versions are affected by CVE-2018-1000150?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:reverse-proxy-auth-plugin. It affects 1 product.

Products include Jenkins Reverse Proxy Auth.

How do I fix CVE-2018-1000150?

Upgrade org.jenkins-ci.plugins:reverse-proxy-auth-plugin to 1.6.0 or later.

Is CVE-2018-1000150 being exploited?

There is no known exploitation of CVE-2018-1000150 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2023-32987 Jenkins Reverse Proxy Auth Plugin cross-site request forgery vulnerability High 8.8
• CVE-2022-45384 Jenkins Reverse Proxy Auth Plugin vulnerable due to plaintext storage of passwords Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m9j2-grqf-fg26.