CVE-2018-1000173: Medium severity jenkins vulnerability
A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1000173?
The severity of CVE-2018-1000173 is medium with a score of 5.9.
How does the session fixaction vulnerability affect Jenkins Google Login Plugin?
The session fixaction vulnerability in Jenkins Google Login Plugin 1.3 and older allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.
Which software versions are affected by CVE-2018-1000173?
Jenkins Google Login Plugin versions up to and including 1.3 are affected by CVE-2018-1000173.
Is there a fix available for CVE-2018-1000173?
Yes, a fix is available for CVE-2018-1000173. It is recommended to upgrade to a version of Jenkins Google Login Plugin newer than 1.3.
Where can I find more information about CVE-2018-1000173?
You can find more information about CVE-2018-1000173 at the following references: [1](http://www.securityfocus.com/bid/104210) and [2](https://jenkins.io/security/advisory/2018-04-16/).