CVE-2019-1003021

—

CVSS 3.0

4.3 medium

EPSS

1%p64

Published

Feb 6, 2019 (Feb 6, 2019)

Modified

Jun 17, 2026

Description

An exposure of sensitive information vulnerability exists in Jenkins OpenId Connect Authentication Plugin 1.4 and earlier in OicSecurityRealm/config.jelly that allows attackers able to view a Jenkins administrator's web browser output, or control the browser (e.g. malicious extension) to retrieve the configured client secret.

Vendors: jenkins
Products: openid connect authentication
Weakness: CWE-200
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.1%)

In the news0 stories

No ingested article mentions this CVE yet.