CVE-2015-5298

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Google Login Plugin (versions 1.0 and 1.1) allows malicious anonymous users to authenticate successfully against Jenkins instances that are supposed to be locked down to a particular Google Apps domain through client-side request modification.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	Jenkins Google Login Plugin	Jenkins Google Login Plugin 1.0 and 1.1

References

http://exfiltrated.com/research-CVE-2015-5298.phpThird Party Advisory
https://www.jenkins.io/security/advisory/2015-10-12/Vendor Advisory
http://exfiltrated.com/research-CVE-2015-5298.phpThird Party Advisory
https://www.jenkins.io/security/advisory/2015-10-12/Vendor Advisory

Timeline

Published: Jul 7, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-52995.3The shadow_copy2_get_shadow_copy_data function in modules/vfs_shadow_copy2.c in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3 CVE-2015-53007.5The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseco CVE-2015-53015.5providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check CVE-2015-53025.0libreport 2.0.7 before 2.6.3 only saves changes to the first file when editing a crash report, which allows remote attackers to obtain sensi CVE-2015-53037.5The TripleO Heat templates (tripleo-heat-templates), when deployed via the commandline interface, allow remote attackers to spoof OpenStack CVE-2015-53043.5Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.5 does not properly authorize access to shut down the server, which allows re CVE-2015-53056.4Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files v CVE-2015-53066.8OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access th CVE-2015-53074.9The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host O CVE-2015-53087.5Multiple SQL injection vulnerabilities in cs_admin_users.php in the wp-championship plugin 5.8 for WordPress allow remote attackers to execu CVE-2015-53094.3Integer overflow in the terminal emulator in PuTTY before 0.66 allows remote attackers to cause a denial of service (memory corruption) or p CVE-2015-53104.3The WNM Sleep Mode code in wpa_supplicant 2.x before 2.6 does not properly ignore key data in response frames when management frame protecti