GHSA-p487-39h9-hm84
Jenkins Google Login Plugin 1.0 and 1.1 allows anonymous users to authenticate through client-side request modification
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins:google-login | >= 1.0, < 1.2 | 1.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
The Google Login Plugin (versions 1.0 and 1.1) allows malicious anonymous users to authenticate successfully against Jenkins instances that are supposed to be locked down to a particular Google Apps domain through client-side request modification.
References
External links from the advisory. They lead to third-party sites.