What is GHSA-rp82-xvg3-727c?

GHSA-rp82-xvg3-727c is a security advisory published by GitHub Security Advisories with Medium severity. Jenkins Google Login Plugin Session Fixation vulnerability

Which CVE IDs does GHSA-rp82-xvg3-727c cover?

GHSA-rp82-xvg3-727c covers the following CVE IDs: CVE-2018-1000173. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rp82-xvg3-727c?

GHSA-rp82-xvg3-727c has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

Which products are affected by GHSA-rp82-xvg3-727c?

GHSA-rp82-xvg3-727c affects 1 product, including: maven/org.jenkins-ci.plugins:google-login:\u003c= 1.3.

GHSA-rp82-xvg3-727cMediumCVSS 5.9

Jenkins Google Login Plugin Session Fixation vulnerability

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

January 28, 2023

🔗 CVE IDs covered (1)

CVE-2018-1000173 →

📋 Description

A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session. Google Login Plugin 1.3.1 invalidates the previous session during login, and creates a new one.

🎯 Affected products1

maven/org.jenkins-ci.plugins:google-login:<= 1.3

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2018-1000173
https://jenkins.io/security/advisory/2018-04-16/
http://www.securityfocus.com/bid/104210
https://github.com/advisories/GHSA-rp82-xvg3-727c