CVE-2019-10319

Name of the Vulnerable Software and Affected Versions Jenkins PAM Authentication Plugin versions 1.5 and earlier, except version 1.4.1

Description A missing permission check in the PamSecurityRealm.DescriptorImpl#doTest function allowed users with Overall/Read permission to obtain limited information about the file /etc/shadow and the user Jenkins is running as.

Recommendations For Jenkins PAM Authentication Plugin versions 1.5 and earlier, except version 1.4.1, consider updating to a version that includes the necessary permission checks to prevent unauthorized access to sensitive information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.