GitHub Advisoryadvisory · Maven

GHSA-j279-cx9m-jv3w Jenkins Google Login Plugin Open Redirect vulnerability

MEDIUM Published 2022-05-14 Modified 2022-12-12 Official page ↗
Aliases
CVE-2018-1000174
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:google-login
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-601
Reviewed
2022-12-12

Affected packages

• Maven org.jenkins-ci.plugins:google-login: < 1.3.1 → fixed in 1.3.1

Description

An open redirect vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows attackers to redirect users to an arbitrary URL after successful login. Google Login Plugin 1.3.1 only performs redirects to relative URLs.

Related

Alias · CVE (1)

  • CVE-2018-1000174 An open redirect vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows attackers… vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References