CVE-2019-1003019 GitHub Authentication Plugin session fixation vulnerability
Attackers can impersonate users by controlling pre-authentication sessions in the Jenkins GitHub Authentication Plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-1003019?
CVE-2019-1003019 is a medium-severity authentication bypass vulnerability in Jenkins GitHub Authentication Plugin, published on 6 Feb 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.
Weakness: CWE-384
Which versions are affected by CVE-2019-1003019?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:github-oauth. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:github-oauth Maven | All versions | 0.31 |
org.jenkins-ci.plugins:github-oauth Maven | All versions | 0.31 |
Products include Jenkins Github Oauth.
How do I fix CVE-2019-1003019?
Upgrade org.jenkins-ci.plugins:github-oauth to 0.31 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-1003019 being exploited?
There is no known exploitation of CVE-2019-1003019 in the wild and no public exploit code.
Other vulnerabilities in Jenkins GitHub Authentication Plugin
Sources
Also known as GHSA-mcqx-wc2j-qx9v.