PT-2018-9344 · Jenkins · Jenkins Google Login Plugin+1

Postmanclient + 1 · Published 2018-05-08 · Updated 2022-05-14 · CVE-2018-1000174

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Google Login Plugin versions 1.3 and older

Description An open redirect issue exists in the GoogleOAuth2SecurityRealm.java file, allowing attackers to redirect users to an arbitrary URL after a successful login.

Recommendations For Jenkins Google Login Plugin versions 1.3 and older, update to version 1.3.1 or newer, which only performs redirects to relative URLs, to resolve the issue.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2018-1000174

GHSA-J279-CX9M-JV3W

Affected Products

Jenkins

Jenkins Google Login Plugin

References · 6

• https://jenkins.io/security/advisory/2018-04-16 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000174 · Security Note
• https://osv.dev/vulnerability/GHSA-j279-cx9m-jv3w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1000174 · Vendor Advisory
• https://github.com/jenkinsci/google-login-plugin · Note
• http://securityfocus.com/bid/104211 · Note