CVE-2018-1000174 - An open redirect vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2Se

CVE-2018-1000174

Summary

An open redirect vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows attackers to redirect users to an arbitrary URL after successful login.

References

Vulnerable Configurations

cpe:2.3:a:jenkins:google_login:1.0:*:*:*:*:jenkins:*:*
cpe:2.3:a:jenkins:google_login:1.0:*:*:*:*:jenkins:*:*
cpe:2.3:a:jenkins:google_login:1.1:*:*:*:*:jenkins:*:*
cpe:2.3:a:jenkins:google_login:1.1:*:*:*:*:jenkins:*:*
cpe:2.3:a:jenkins:google_login:1.2:*:*:*:*:jenkins:*:*
cpe:2.3:a:jenkins:google_login:1.2:*:*:*:*:jenkins:*:*
cpe:2.3:a:jenkins:google_login:1.2.1:*:*:*:*:jenkins:*:*
cpe:2.3:a:jenkins:google_login:1.2.1:*:*:*:*:jenkins:*:*
cpe:2.3:a:jenkins:google_login:1.3:*:*:*:*:jenkins:*:*
cpe:2.3:a:jenkins:google_login:1.3:*:*:*:*:jenkins:*:*

CVSS

Base:	5.8 (as of 13-06-2018 - 14:53)
Impact:
Exploitability:

CWE

CWE-601

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	NONE

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:N

refmap via4

bid	104211
confirm	https://jenkins.io/security/advisory/2018-04-16/

Last major update

13-06-2018 - 14:53

Published

08-05-2018 - 15:29

Last modified

13-06-2018 - 14:53