Cleartext Storage of Sensitive Information Affecting org.jenkins-ci.plugins:oic-auth package, versions [0,]
Threat Intelligence
EPSS
0.04% (6th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGJENKINSCIPLUGINS-6124887
- published 14 Dec 2023
- disclosed 13 Dec 2023
- credit Unknown
Introduced: 13 Dec 2023
CVE-2023-50770 Open this link in a new tabHow to fix?
There is no fixed version for org.jenkins-ci.plugins:oic-auth.
Overview
org.jenkins-ci.plugins:oic-auth is a Jenkins plugin which lets you login to Jenkins using your own, self-hosted or public openid connect server.
Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information due to improper storage of a local user account password. An attacker with access to the Jenkins controller file system can recover the plain text password of that account, potentially gaining administrator access to Jenkins.
References
CVSS Scores
version 3.1