CVE-2019-10371
First published: Wed Aug 07 2019(Updated: )
A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Gitlab Oauth | <=1.4 | |
| maven/org.jenkins-ci.plugins:gitlab-oauth | <=1.4 | 1.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2019/08/07/1
- https://jenkins.io/security/advisory/2019-08-07/#SECURITY-795
- https://nvd.nist.gov/vuln/detail/CVE-2019-10371
- https://github.com/jenkinsci/gitlab-oauth-plugin/commit/695ce63fddb3567cf8d87339ddc1fa3b67ae2db8
- https://github.com/advisories/GHSA-682g-c99v-9r2g (Advisory)
Frequently Asked Questions
What is the vulnerability ID for this session fixation vulnerability in Jenkins Gitlab Authentication Plugin?
The vulnerability ID for this session fixation vulnerability in Jenkins Gitlab Authentication Plugin is CVE-2019-10371.
What is the title of this vulnerability?
The title of this vulnerability is 'A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java'.
What is the impact of this vulnerability?
This vulnerability allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.
Which software versions are affected by this vulnerability?
Jenkins Gitlab Authentication Plugin version 1.4 and earlier in GitLabSecurityRealm.java are affected by this vulnerability.
What is the severity level of this vulnerability?
The severity level of this vulnerability is high with a score of 7.5.
- collector/nvd-index
- collector/nvd-api
- collector/nvd-cve
- collector/github-advisory-latest
- alias/GHSA-682g-c99v-9r2g
- alias/CVE-2019-10371
- collector/github-advisory
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/author
- agent/references
- agent/last-modified-date
- agent/description
- agent/tags
- agent/first-publish-date
- agent/event
- agent/trending
- vendor/jenkins
- canonical/jenkins gitlab oauth
- version/jenkins gitlab oauth/1.4
- package-manager/maven