PT-2018-9343 · Jenkins · Jenkins Google Login Plugin+1

Emeric Vernat · Publicado 2018-05-08 · Atualizado 2022-05-14 · CVE-2018-1000173

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Google Login Plugin versions 1.3 and older

Description A session fixaction vulnerability exists in the GoogleOAuth2SecurityRealm.java file, allowing unauthorized attackers to impersonate another user if they can control the pre-authentication session. This issue can be exploited by attackers who can manipulate the session before authentication.

Recommendations For Jenkins Google Login Plugin versions 1.3 and older, update to version 1.3.1 or newer, which invalidates the previous session during login and creates a new one, thus addressing the issue.

Correção

Session Fixation

Enumeração de Fraquezas

CWE-384

Identificadores relacionados

CVE-2018-1000173

GHSA-RP82-XVG3-727C

Produtos afetados

Jenkins

Jenkins Google Login Plugin

Referências · 6

• https://github.com/jenkinsci/google-login-plugin · Nota
• https://jenkins.io/security/advisory/2018-04-16 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-rp82-xvg3-727c · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1000173 · Aviso do Fabricante
• http://securityfocus.com/bid/104210 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000173 · Nota de Segurança