Jenkins Gitlab Authentication Plugin vulnerable to Session Fixation

2022-05-2416:52:45

Google

osv.dev

0.002 Low

EPSS

Percentile

55.1%

JSON

A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.

CPENameOperatorVersion
org.jenkins-ci.plugins:gitlab-oautheq1.3
org.jenkins-ci.plugins:gitlab-oautheq1.0.5
org.jenkins-ci.plugins:gitlab-oautheq1.0.9
org.jenkins-ci.plugins:gitlab-oautheq1.4
org.jenkins-ci.plugins:gitlab-oautheq1.1
org.jenkins-ci.plugins:gitlab-oautheq1.0.6
org.jenkins-ci.plugins:gitlab-oautheq1.0.3
org.jenkins-ci.plugins:gitlab-oautheq1.0.8
org.jenkins-ci.plugins:gitlab-oautheq1.0.4
org.jenkins-ci.plugins:gitlab-oautheq1.2

Name	Operator	Version
org.jenkins-ci.plugins:gitlab-oauth	eq	1.3
org.jenkins-ci.plugins:gitlab-oauth	eq	1.0.5
org.jenkins-ci.plugins:gitlab-oauth	eq	1.0.9
org.jenkins-ci.plugins:gitlab-oauth	eq	1.4
org.jenkins-ci.plugins:gitlab-oauth	eq	1.1
org.jenkins-ci.plugins:gitlab-oauth	eq	1.0.6
org.jenkins-ci.plugins:gitlab-oauth	eq	1.0.3
org.jenkins-ci.plugins:gitlab-oauth	eq	1.0.8
org.jenkins-ci.plugins:gitlab-oauth	eq	1.0.4
org.jenkins-ci.plugins:gitlab-oauth	eq	1.2