<p>Upgrade <code>org.jenkins-ci.plugins:azure-ad</code> to version 0.3.4 or higher.</p>

Information Exposure Affecting org.jenkins-ci.plugins:azure-ad package, versions [,0.3.4)

Snyk CVSS

Attack Complexity Low

Threat Intelligence

EPSS 0.22% (60^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-JAVA-ORGJENKINSCIPLUGINS-174559
published 1 May 2019
disclosed 30 Apr 2019
credit Mark Combellack

Report a new vulnerability Found a mistake?

Introduced: 30 Apr 2019

CVE-2019-10318 Open this link in a new tab CWE-200 Open this link in a new tab

How to fix?

Upgrade org.jenkins-ci.plugins:azure-ad to version 0.3.4 or higher.

Overview

org.jenkins-ci.plugins:azure-ad is a Jenkins Plugin that supports authentication & authorization via Azure Active Directory.

Affected versions of this package are vulnerable to Information Exposure. It stored the client secret unencrypted in the global config.xml configuration file on the Jenkins master where it could be viewed by users with access to the master file system.