CVE-2019-1003019

Published: Feb 6, 2019Modified: Jun 17, 2026

5.9

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.

Affected (1)

Products: Jenkins: Github Oauth

Jenkins

1 product

Github Oauth

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jenkins Github Oauth	Up to 0.29

Related CWEs

CWE-384

Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References (2)

https://jenkins.io/security/advisory/2019-01-28/#SECURITY-797

Source: jenkinsci-cert@googlegroups.com

Vendor Advisory

https://jenkins.io/security/advisory/2019-01-28/#SECURITY-797

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.