CVE-2018-1000173 Vulnerability in maven package org.jenkins-ci.plugins:google-login

Description

A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.

Remediation

References

https://jenkins.io/security/advisory/2018-04-16/

http://www.securityfocus.com/bid/104210

Related Vulnerabilities

CVE-2022-31103 Vulnerability in npm package lettersanitizer

CVE-2020-16023 Vulnerability in maven package org.webjars.npm:electron

CVE-2023-34459 Vulnerability in npm package @openzeppelin/contracts

CVE-2020-26217 Vulnerability in maven package xstream:xstream

CVE-2023-49280 Vulnerability in maven package org.xwiki.contrib.changerequest:application-changerequest-default

Severity

Medium

Classification

CWE-384 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N