GitHub Advisoryadvisory · Maven

GHSA-p487-39h9-hm84 Jenkins Google Login Plugin 1.0 and 1.1 allows anonymous users to authenticate through client-side request modification

MEDIUM Published 2022-07-08 Modified 2022-07-20 Official page ↗
Aliases
CVE-2015-5298
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:google-login
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-287
Reviewed
2022-07-20

Affected packages

• Maven org.jenkins-ci.plugins:google-login: >= 1.0, < 1.2 → fixed in 1.2

Description

The Google Login Plugin (versions 1.0 and 1.1) allows malicious anonymous users to authenticate successfully against Jenkins instances that are supposed to be locked down to a particular Google Apps domain through client-side request modification.

Related

Alias · CVE (1)

  • CVE-2015-5298 The Google Login Plugin (versions 1.0 and 1.1) allows malicious anonymous users to authenticate successfully against Jenkins instances that… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References