Not rated
CVE-2019-1003099 A missing permission check in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form…
Description
A missing permission check in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins openid Plugin | Versions not published |
Other CVEs of Jenkins openid Plugin
The 5 CVEs of Jenkins openid Plugin →
CVE-2023-24444
Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login
9.8
Critical
CVE-2023-24445
Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing…
6.1
Medium
CVE-2023-24446
A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick…
8.8
High
CVE-2019-1003098
A cross-site request forgery vulnerability in Jenkins openid Plugin in the…
Not rated