PT-2018-9344 · Jenkins · Jenkins Google Login Plugin+1

Postmanclient + 1 · Publicado 2018-05-08 · Atualizado 2022-05-14 · CVE-2018-1000174

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Google Login Plugin versions 1.3 and older

Description An open redirect issue exists in the GoogleOAuth2SecurityRealm.java file, allowing attackers to redirect users to an arbitrary URL after a successful login.

Recommendations For Jenkins Google Login Plugin versions 1.3 and older, update to version 1.3.1 or newer, which only performs redirects to relative URLs, to resolve the issue.

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2018-1000174

GHSA-J279-CX9M-JV3W

Produtos afetados

Jenkins

Jenkins Google Login Plugin

Referências · 6

• https://github.com/jenkinsci/google-login-plugin · Nota
• http://securityfocus.com/bid/104211 · Nota
• https://jenkins.io/security/advisory/2018-04-16 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000174 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-j279-cx9m-jv3w · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1000174 · Aviso do Fabricante