GitHub Advisoryadvisory · Maven

GHSA-6r5w-jjr5-qvgr Password stored in a recoverable format by Jenkins OpenId Connect Authentication Plugin

MEDIUM Published 2023-12-13 Modified 2024-11-15 Official page ↗
Aliases
CVE-2023-50770
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:oic-auth
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-312, CWE-522
Reviewed
2023-12-13

Affected packages

• Maven org.jenkins-ci.plugins:oic-auth: < 4.229.vf736b → fixed in 4.229.vf736b

Description

Jenkins OpenId Connect Authentication Plugin stores a password of a local user account used as an anti-lockout feature in a recoverable format, allowing attackers with access to the Jenkins controller file system to recover the plain text password of that account, likely gaining administrator access to Jenkins.

Related

Alias · CVE (1)

  • CVE-2023-50770 Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a… vulnerability

Weakness · CWE (2)

  • CWE-312 Cleartext Storage of Sensitive Information weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References