Jenkins Reverse Proxy Auth Plugin allows attackers with local file system access to obtain a list of authorities for logged in users
Low severity
GitHub Reviewed
Published
May 14, 2022
to the GitHub Advisory Database
•
Updated Jan 28, 2023
Package
Affected versions
<= 1.5
Patched versions
1.6.0
Description
Published by the National Vulnerability Database
Apr 5, 2018
Published to the GitHub Advisory Database
May 14, 2022
Reviewed
Dec 12, 2022
Last updated
Jan 28, 2023
An exposure of sensitive information vulnerability exists in Jenkins Reverse Proxy Auth Plugin 1.5 and older in ReverseProxySecurityRealm#authContext that allows attackers with local file system access to obtain a list of authorities for logged in users. Reverse Proxy Auth Plugin 1.6.0 and newer no longer store the cache of granted authorities on disk.
References