GCVE - cpe:2.3:a:jenkins:google_login:*:*:*:*:*:jenkins:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:jenkins:google_login:*:*:*:*:*:jenkins:*:*

part: a version: * update: *

Vendor	Jenkins (`d708d718-2e77-5ca3-ae9c-38ee4d256744`)
Product	Google Login (`06949b52-2a63-5192-ad8f-5e0746fa167f`)
Edition	*
Language	*
Software edition	*
Target software	jenkins
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-41936`	vulnerable	2026-06-08 06:11:07.447479	Details available Jenkins Google Login Plugin 1.7 and earlier uses a non-constant time comparison function when checking whether the provided and expected token are equal, potentially allowing attackers to use statistical methods to obtain a valid token. Published: 2023-09-06T12:08:56.365Z Updated: 2024-09-26T19:54:41.046Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3228 http://www.openwall.com/lists/oss-security/2023/09/06/9	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-46683`	vulnerable	2026-06-08 05:50:39.168844	Details available Jenkins Google Login Plugin 1.4 through 1.6 (both inclusive) improperly determines that a redirect URL after login is legitimately pointing to Jenkins. Published: 2022-12-07T00:00:00.000Z Updated: 2025-04-23T15:46:12.412Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2022-12-07/#SECURITY-2967	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-1000174`	vulnerable	2026-06-08 05:10:25.580286	Details available An open redirect vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows attackers to redirect users to an arbitrary URL after successful login. Published: 2018-05-08T15:00:00.000Z Updated: 2024-08-05T12:33:49.343Z Open on db.gcve.eu Reference links https://jenkins.io/security/advisory/2018-04-16/ http://www.securityfocus.com/bid/104211	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-1000173`	vulnerable	2026-06-08 05:10:25.579889	Details available A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session. Published: 2018-05-08T15:00:00.000Z Updated: 2024-08-05T12:33:49.334Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/104210 https://jenkins.io/security/advisory/2018-04-16/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.