CVE-2019-10436

An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master.

Score

CVSS 3.1 6.5 Medium

Status

Modified - jenkinsci-cert@googlegroups.com

Published

2019-10-16

Last modified

2024-08-04

Affected products

• Google Oauth Credentials (Jenkins)
• Jenkins Google Oauth Credentials Plugin (Jenkins Project)

References

• https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1583