critical
9.1
CWE
863 285 358
Advisory Published
CVE Published
Updated

CVE-2020-7692: Improper Authorization

First published: Fri Jul 03 2020(Updated: )

PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.

Credit: report@snyk.io

Affected SoftwareAffected VersionHow to fix
redhat/jenkins<2-plugins-0:4.13.1684911916-1.el8
2-plugins-0:4.13.1684911916-1.el8
redhat/jenkins<2-plugins-0:4.10.1675144701-1.el8
2-plugins-0:4.10.1675144701-1.el8
redhat/jenkins<2-plugins-0:4.9.1675668922-1.el8
2-plugins-0:4.9.1675668922-1.el8
redhat/google-oauth-client<1.31.0
1.31.0
Google OAuth Client Library for Java<1.31.0

Remedy

https://github.com/googleapis/google-oauth-java-client/commit/13433cd7dd06267fc261f0b1d4764f8e3432c824

Remedy

https://lists.apache.org/thread.html/reae8909b264d1103f321b9ce1623c10c1ddc77dba9790247f2c0c90f@%3Ccommits.druid.apache.org%3E

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is the severity of CVE-2020-7692?

    CVE-2020-7692 has a high severity rating due to the lack of proper PKCE implementation which may expose sensitive data.

  • How do I fix CVE-2020-7692?

    To resolve CVE-2020-7692, update the vulnerable packages to the recommended versions: google-oauth-client to 1.31.0 and Jenkins plugins to 4.13.1684911916-1.el8, 4.10.1675144701-1.el8, or 4.9.1675668922-1.el8.

  • Which software is affected by CVE-2020-7692?

    CVE-2020-7692 affects the google-oauth-client library and multiple versions of Jenkins plugins.

  • What is the main issue with CVE-2020-7692?

    The main issue with CVE-2020-7692 is that the PKCE support for OAuth 2.0 is not implemented as per the standard, leading to potential security vulnerabilities.

  • Is CVE-2020-7692 a client-side vulnerability?

    Yes, CVE-2020-7692 is considered a client-side vulnerability due to its impact on native applications utilizing OAuth 2.0.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203