GHSA-rp82-xvg3-727c

ghsaUSosv

Jenkins Google Login Plugin Session Fixation vulnerability

view advisory published 2022-05-14Licence: CC-BY-4.0

A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session. Google Login Plugin 1.3.1 invalidates the previous session during login, and creates a new one.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2018-1000173US	medium5.9	1.50% (74th)	—	2018-05-08
A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows unauthorized attackers to impersonate another us…

references

External citations — patches, advisories, analysis.

http://www.securityfocus.com/bid/104210WEB
https://github.com/jenkinsci/google-login-pluginPACKAGE
https://jenkins.io/security/advisory/2018-04-16WEB
https://nvd.nist.gov/vuln/detail/CVE-2018-1000173ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan