CVE-2015-5298: Jenkins Google Login Plugin - Client-side Request Modification
Summary
CVE-2015-5298: The Google Login Plugin (versions 1.0 and 1.1) allows malicious anonymous users to authenticate successfully against Jenkins instances that are supposed to be locked down to a particular Google Apps domain through client... Affects org.jenkins-ci.plugins:google-login versions >= 1.0, < 1.2. Fixed in 1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Google Login Plugin is a Maven package (org.jenkins-ci.plugins:google-login) that provides authentication functionality for Jenkins instances using Google accounts. It allows users to log in to Jenkins using their Google credentials, providing a convenient and secure authentication method.
Vulnerability Detail
The Google Login Plugin versions 1.0 and 1.1 suffer from a vulnerability that allows anonymous users to authenticate successfully against Jenkins instances that are supposed to be restricted to a specific Google Apps domain. This vulnerability occurs due to a lack of proper server-side validation of authentication requests, allowing malicious users to modify client-side requests and bypass the intended domain restrictions. The impact of this vulnerability is that unauthorized users can gain access to Jenkins instances and potentially perform unauthorized actions.
How To Fix
Minimum fixed version
1.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of the Google Login Plugin.
Conclusion
The Jenkins Google Login Plugin versions 1.0 and 1.1 are vulnerable to client-side request modification, allowing unauthorized users to authenticate against restricted instances. To mitigate this vulnerability, it is crucial to upgrade to version 1.2 or later of the plugin. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:google-login →
FAQ
The Jenkins Google Login Plugin is a plugin that enables users to authenticate to Jenkins using their Google accounts.
Versions 1.0 and 1.1 of the Google Login Plugin are affected by this vulnerability.
The vulnerability allows unauthorized users to authenticate successfully against Jenkins instances that should be restricted to a specific Google Apps domain.
To fix this vulnerability, upgrade the Google Login Plugin to version 1.2 or later.
No, there is no known workaround. It is necessary to apply the recommended fix by upgrading the plugin.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:google-login.
