GitHub Advisoryadvisory · Maven

GHSA-8qh4-fghr-6fxg Improper Limitation of a Pathname to a Restricted Directory in Jenkins Google OAuth Credentials Plugin

MEDIUM Published 2022-05-24 Modified 2022-06-28 Official page ↗
Aliases
CVE-2019-10436
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:google-oauth-plugin
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2022-06-28

Affected packages

• Maven org.jenkins-ci.plugins:google-oauth-plugin: < 0.10 → fixed in 0.10

Description

An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master.

Related

Alias · CVE (1)

  • CVE-2019-10436 An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References