Miggo Logo
Miggo Vulnerability Database
→
CVE-2019-10371

CVE-2019-10371: Jenkins Gitlab Authentication Plugin vulnerable to Session Fixation

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2019-10371
GHSA ID
GHSA-682g-c99v-9r2g
EPSS Score
0.17326%
CWE
CWE-384
Published
5/24/2022
Updated
12/6/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jenkins-ci.plugins:gitlab-oauthmaven<= 1.41.5

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from missing session invalidation during authentication. The commit diff shows the fix added session invalidation logic (session.invalidate() and request.getSession(true)) in doFinishLogin, indicating this was the vulnerable entry point. The CWE-384 description confirms this matches session fixation patterns where pre-auth sessions aren't properly cycled.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* s*ssion *ix*tion vuln*r**ility in J*nkins *itl** *ut**nti**tion Plu*in *.* *n* **rli*r in *itL**S**urityR**lm.j*v* *llows un*ut*oriz** *tt**k*rs to imp*rson*t* *not**r us*r i* t**y **n *ontrol t** pr*-*ut**nti**tion s*ssion.

Reasoning

T** vuln*r**ility st*ms *rom missin* s*ssion inv*li**tion *urin* *ut**nti**tion. T** *ommit *i** s*ows t** *ix ***** s*ssion inv*li**tion lo*i* (`s*ssion.inv*li**t*()` *n* `r*qu*st.**tS*ssion(tru*)`) in *o*inis*Lo*in, in*i**tin* t*is w*s t** vuln*r**