Jenkins Gitlab Authentication Plugin vulnerable to Session Fixation

2022-05-2416:52:45

Google

osv.dev

jenkins

gitlab

authentication

plugin

session fixation

vulnerability

security realm

unauthorized attackers

EPSS

0.002

Percentile

55.1%

JSON

A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.

References

www.openwall.com/lists/oss-security/2019/08/07/1

github.com/jenkinsci/gitlab-oauth-plugin/commit/695ce63fddb3567cf8d87339ddc1fa3b67ae2db8

jenkins.io/security/advisory/2019-08-07/#SECURITY-795

nvd.nist.gov/vuln/detail/CVE-2019-10371

EPSS

0.002

Percentile

55.1%

JSON

Related for OSV:GHSA-682G-C99V-9R2G