PT-2018-9322
CVE-2018-1000150
·
تاريخ النشر
2018-04-05
·
تاريخ التحديث
2022-05-14
الوصف من
CVSS 3.1
3.3
منخفضةالمقاييسAV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Jenkins Reverse Proxy Auth Plugin versions 1.5 and older
Description
An exposure of sensitive information issue exists in the ReverseProxySecurityRealm#authContext that allows attackers with local file system access to obtain a list of authorities for logged in users. This occurs because the cache of granted authorities is stored on disk, which can be accessed by attackers.
Recommendations
For Jenkins Reverse Proxy Auth Plugin versions 1.5 and older, update to version 1.6.0 or newer, as these versions no longer store the cache of granted authorities on disk.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾