GHSA-j279-cx9m-jv3w

ghsaUSosv

Jenkins Google Login Plugin Open Redirect vulnerability

view advisory published 2022-05-14Licence: CC-BY-4.0

An open redirect vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows attackers to redirect users to an arbitrary URL after successful login. Google Login Plugin 1.3.1 only performs redirects to relative URLs.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2018-1000174US	medium6.1	0.95% (61st)	—	2018-05-08
An open redirect vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows attackers to redirect users to an arbitrary URL aft…

references

External citations — patches, advisories, analysis.

http://www.securityfocus.com/bid/104211WEB
https://github.com/jenkinsci/google-login-pluginPACKAGE
https://jenkins.io/security/advisory/2018-04-16WEB
https://nvd.nist.gov/vuln/detail/CVE-2018-1000174ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan