CVE-2019-1003021 Jenkins OpenId Connect Authentication Plugin showed plain text client secret in configuration form

Medium 4.3 Published 6 Feb 2019 Updated 17 Sep 2024

Attackers with browser access can retrieve the configured client secret from the Jenkins OpenId Connect Authentication Plugin configuration page.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2019-1003021?

CVE-2019-1003021 is a medium-severity vulnerability in Jenkins OpenId Connect Authentication Plugin, published on 6 Feb 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

An exposure of sensitive information vulnerability exists in Jenkins OpenId Connect Authentication Plugin 1.4 and earlier in OicSecurityRealm/config.jelly that allows attackers able to view a Jenkins administrator's web browser output, or control the browser (e.g. malicious extension) to retrieve the configured client secret.

Weakness: CWE-200

Which versions are affected by CVE-2019-1003021?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:oic-auth. It affects 1 product.

Package	Affected	Fixed in
`org.jenkins-ci.plugins:oic-auth` Maven	All versions	`1.5`
`org.jenkins-ci.plugins:oic-auth` Maven	All versions	`1.5`

Products include Jenkins Openid Connect Authentication.

How do I fix CVE-2019-1003021?

Upgrade org.jenkins-ci.plugins:oic-auth to 1.5 or later.

Is CVE-2019-1003021 being exploited?

There is no known exploitation of CVE-2019-1003021 in the wild and no public exploit code.

Sources

Also known as GHSA-3858-58w9-wpcg.