Medium severity4.3NVD Advisory· Published Feb 6, 2019· Updated Jun 17, 2026

CVE-2019-1003018

Description

An exposure of sensitive information vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm/config.jelly that allows attackers able to view a Jenkins administrator's web browser output, or control the browser (e.g. malicious extension) to retrieve the configured client secret.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:github-oauthMaven	< 0.31	0.31

Affected products

Jenkins Project/Github OAuth
cpe:2.3:a:jenkins:github_oauth:*:*:*:*:*:jenkins:*:*
Range: <=0.29
ghsa-coords
pkg:maven/org.jenkins-ci.plugins/github-oauth
Range: < 0.31
Jenkins Project/GitLab Authentication Plugincpe-rescue
Range: 0.29 and earlier

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-87pj-9q82-m9qhghsaADVISORY
jenkins.io/security/advisory/2019-01-28/nvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2019-1003018ghsaADVISORY
github.com/jenkinsci/github-oauth-plugin/commit/10d173f541e6f060231e778ec25b8c9846109856ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000