CVE-2019-1003018 GitHub Authentication Plugin showed plain text client secret in configuration form
Attackers with browser access can retrieve the configured client secret from the Jenkins GitHub Authentication Plugin configuration page.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-1003018?
CVE-2019-1003018 is a medium-severity vulnerability in Jenkins GitHub Authentication Plugin, published on 6 Feb 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An exposure of sensitive information vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm/config.jelly that allows attackers able to view a Jenkins administrator's web browser output, or control the browser (e.g. malicious extension) to retrieve the configured client secret.
Weakness: CWE-200
Which versions are affected by CVE-2019-1003018?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:github-oauth. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:github-oauth Maven | All versions | 0.31 |
org.jenkins-ci.plugins:github-oauth Maven | All versions | 0.31 |
Products include Jenkins Github Oauth.
How do I fix CVE-2019-1003018?
Upgrade org.jenkins-ci.plugins:github-oauth to 0.31 or later.
Is CVE-2019-1003018 being exploited?
There is no known exploitation of CVE-2019-1003018 in the wild and no public exploit code.
Other vulnerabilities in Jenkins GitHub Authentication Plugin
Sources
Also known as GHSA-87pj-9q82-m9qh.