CVE-2019-10371 - A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attackers to impersonate another user if they can control the pre-authentication session

Back Back to CVE browser

HIGH

A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attackers to impersonate another user if they can control the pre-authentication session

Published Aug 7, 2019

7.5

HIGH

CVSS 3.1

EPSS 1.31%

Description

A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.

Affected products

Vendor Jenkins project Product Jenkins Gitlab Authentication Plugin Default
unknown
Affected
- 1.4 and earlier

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Jenkins project	Jenkins Gitlab Authentication Plugin	unknown	Affected 1.4 and earlier

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-384

References (6)

http://www.openwall.com/lists/oss-security/2019/08/07/1
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2746
Advisory
https://github.com/advisories/GHSA-682g-c99v-9r2g
Advisory
https://github.com/jenkinsci/gitlab-oauth-plugin/commit/695ce63fddb3567cf8d87339ddc1fa3b67ae2db8
https://jenkins.io/security/advisory/2019-08-07/#SECURITY-795
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10371

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2019/08/07/1		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2746		Advisory
https://github.com/advisories/GHSA-682g-c99v-9r2g		Advisory
https://github.com/jenkinsci/gitlab-oauth-plugin/commit/695ce63fddb3567cf8d87339ddc1fa3b67ae2db8
https://jenkins.io/security/advisory/2019-08-07/#SECURITY-795		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10371