Improper Limitation of a Pathname to a Restricted Directory in Jenkins Google OAuth Credentials Plugin

2022-05-2416:58:49

CWE-22

GitHub Advisory Database

github.com

0.001 Low

EPSS

Percentile

27.9%

JSON

An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master.

CPENameOperatorVersion
org.jenkins-ci.plugins:google-oauth-pluginle0.9

CPE	Name	Operator	Version
	org.jenkins-ci.plugins:google-oauth-plugin	le	0.9

References

github.com/advisories/GHSA-8qh4-fghr-6fxg

github.com/jenkinsci/google-oauth-plugin/commit/aef26a8425e515a9986412000d6191db95fa9e56

jenkins.io/security/advisory/2019-10-16/#SECURITY-1583

nvd.nist.gov/vuln/detail/CVE-2019-10436

0.001 Low

EPSS

Percentile

27.9%

JSON

Related for GHSA-8QH4-FGHR-6FXG