PT-2018-9343 · Jenkins · Jenkins Google Login Plugin+1

Emeric Vernat · Published 2018-05-08 · Updated 2022-05-14 · CVE-2018-1000173

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Google Login Plugin versions 1.3 and older

Description A session fixaction vulnerability exists in the GoogleOAuth2SecurityRealm.java file, allowing unauthorized attackers to impersonate another user if they can control the pre-authentication session. This issue can be exploited by attackers who can manipulate the session before authentication.

Recommendations For Jenkins Google Login Plugin versions 1.3 and older, update to version 1.3.1 or newer, which invalidates the previous session during login and creates a new one, thus addressing the issue.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2018-1000173

GHSA-RP82-XVG3-727C

Affected Products

Jenkins

Jenkins Google Login Plugin

References · 6

• https://jenkins.io/security/advisory/2018-04-16 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rp82-xvg3-727c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1000173 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000173 · Security Note
• https://github.com/jenkinsci/google-login-plugin · Note
• http://securityfocus.com/bid/104210 · Note