jenkinsci/github-oauth-plugin · Security
GitHub Authentication Plugin session fixation vulnerability
- GHSA ID
- GHSA-mcqx-wc2j-qx9v
- CVE ID
- CVE-2019-1003019
- Severity
- medium
- Published
- Updated
- CVSS
- 5.9 · CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS v3
- 5.9 · CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Description
An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.
CWEs
- CWE-384 · Session Fixation