Description

A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.

Remediation

References

http://www.securityfocus.com/bid/104210

https://jenkins.io/security/advisory/2018-04-16/

Related Vulnerabilities

CVE-2018-13797 Vulnerability in npm package macaddress

CVE-2017-16177 Vulnerability in npm package chatbyvista

CVE-2017-2585 Vulnerability in maven package org.keycloak:keycloak-server-spi-private

CVE-2022-23631 Vulnerability in npm package superjson

CVE-2022-25912 Vulnerability in npm package simple-git

Severity

Medium

Classification

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Third Party Advisory VDB Entry Vendor Advisory CWE-384