Session Fixation Vulnerability in Jenkins Google Login Plugin
CVE-2018-1000173

5.9MEDIUM

Key Information:

Vendor

Jenkins
Status
Google Login
Vendor
CVE Published:
8 May 2018

What is CVE-2018-1000173?

A session fixation vulnerability is present in the Jenkins Google Login Plugin version 1.3 and earlier, specifically impacting the GoogleOAuth2SecurityRealm.java component. This flaw enables unauthorized attackers to impersonate legitimate users if they gain control over the pre-authentication session, ultimately bypassing expected security protocols. Developers and administrators should apply appropriate patches and implement enhanced session handling measures to mitigate the risk of exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

http://www.securityfocus.com/bid/104210
vdb-entryx_refsource_BID
https://jenkins.io/security/advisory/2018-04-16/
x_refsource_CONFIRM

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.