GHSA-j279-cx9m-jv3w

Jenkins Google Login Plugin Open Redirect vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-1000174

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:google-login	< 1.3.1	1.3.1

Details

As written in the advisory (Markdown source, shown as plain text).

An open redirect vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows attackers to redirect users to an arbitrary URL after successful login. Google Login Plugin 1.3.1 only performs redirects to relative URLs.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1000174 advisory
https://github.com/jenkinsci/google-login-plugin package
https://jenkins.io/security/advisory/2018-04-16 web
http://www.securityfocus.com/bid/104211 web