PT-2022-27947 · Jenkins · Jenkins Google Login Plugin+1

Wadeck Follonier · Published 2022-12-07 · Updated 2022-12-12 · CVE-2022-46683

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Google Login Plugin versions 1.4 through 1.6

Description The issue arises from the improper determination of a redirect URL after login, which is supposed to point to Jenkins. This could potentially lead to unauthorized access. The Google Login Plugin version 1.7 has addressed this by only redirecting to relative Jenkins URLs.

Recommendations For Jenkins Google Login Plugin versions 1.4 through 1.6, update to version 1.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the login functionality to minimize the risk of exploitation.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2022-46683

GHSA-V93C-CXJ5-C398

Affected Products

Jenkins

Jenkins Google Login Plugin

References · 8

• https://osv.dev/vulnerability/CVE-2022-46683 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46683 · Security Note
• https://osv.dev/vulnerability/GHSA-v93c-cxj5-c398 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-12-07/#SECURITY-2967 · Vendor Advisory
• https://github.com/jenkinsci/google-login-plugin/commit/532d714943ff8ae8dc862427d39a4b78b7f6a375 · Note
• https://github.com/jenkinsci/google-login-plugin · Note
• https://t.me/cvenotify/39615 · Telegram Post
• https://t.me/cvenotify/39673 · Telegram Post