Medium severity5.9NVD Advisory· Published Feb 6, 2019· Updated Jun 17, 2026

CVE-2019-1003019

Description

An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:github-oauthMaven	< 0.31	0.31

Affected products

Jenkins Project/Github OAuth
cpe:2.3:a:jenkins:github_oauth:*:*:*:*:*:jenkins:*:*
Range: <=0.29
ghsa-coords
pkg:maven/org.jenkins-ci.plugins/github-oauth
Range: < 0.31
Jenkins Project/GitLab Authentication Plugincpe-rescue
Range: 0.29 and earlier

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-mcqx-wc2j-qx9vghsaADVISORY
jenkins.io/security/advisory/2019-01-28/nvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2019-1003019ghsaADVISORY
github.com/jenkinsci/github-oauth-plugin/commit/3fcc367022c58486e5f52def3edbac92ed258ba4ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.384
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000