Lucene search

GoogleOSV:GHSA-V93C-CXJ5-C398

HistoryDec 12, 2022 - 9:30 a.m.

Jenkins Google Login Plugin Open Redirect vulnerability

2022-12-1209:30:35

Google

osv.dev

jenkins

google login

plugin

open redirect

vulnerability

1.4

1.6

1.7

relative urls

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

31.5%

JSON

Jenkins Google Login Plugin 1.4 through 1.6 (both inclusive) improperly determines that a redirect URL after login is legitimately pointing to Jenkins. Google Login Plugin 1.7 only redirects to relative (Jenkins) URLs.

CPENameOperatorVersion
org.jenkins-ci.plugins:google-logineq1.4
org.jenkins-ci.plugins:google-logineq1.5
org.jenkins-ci.plugins:google-logineq1.6

Name	Operator	Version
org.jenkins-ci.plugins:google-login	eq	1.4
org.jenkins-ci.plugins:google-login	eq	1.5
org.jenkins-ci.plugins:google-login	eq	1.6

References

github.com/jenkinsci/google-login-plugin

github.com/jenkinsci/google-login-plugin/commit/532d714943ff8ae8dc862427d39a4b78b7f6a375

nvd.nist.gov/vuln/detail/CVE-2022-46683

www.jenkins.io/security/advisory/2022-12-07/#SECURITY-2967

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

31.5%

JSON

Related for OSV:GHSA-V93C-CXJ5-C398