Jenkins Google Login Plugin 1.0 and 1.1 allows anonymous users to authenticate through client-side request modification

Description

References

• nvd.nist.gov/vuln/detail/CVE-2015-5298 · ADVISORY
• jenkinsci/google-login-plugin · PACKAGE
• jenkins.io/security/advisory/2015-10-12 · WEB
• exfiltrated.com/research-CVE-2015-5298.php · WEB
• jenkins.io/security/advisory/2015-10-12 · Vendor Advisory

Mais vulnerabilidades de org.jenkins-ci.plugins:google-login

• CVE-2023-41936ALTO 7.5Jenkins Google Login Plugin 1.7 and earlier uses a non-constant time comparison function when checking whether the provided and expected tok…
• CVE-2022-46683MÉDIO 6.1Jenkins Google Login Plugin 1.4 through 1.6 (both inclusive) improperly determines that a redirect URL after login is legitimately pointing …
• CVE-2018-1000174MÉDIO 6.1An open redirect vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows attackers t…
• CVE-2018-1000173MÉDIO 5.9A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows unauthor…