What is GHSA-8r93-59cf-358f?

GHSA-8r93-59cf-358f is a security advisory published by GitHub Security Advisories with Medium severity. CSRF vulnerability in Jenkins GitLab Branch Source Plugin

Which CVE IDs does GHSA-8r93-59cf-358f cover?

GHSA-8r93-59cf-358f covers the following CVE IDs: CVE-2024-23902. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8r93-59cf-358f?

GHSA-8r93-59cf-358f has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-8r93-59cf-358f?

GHSA-8r93-59cf-358f affects 1 product, including: maven/io.jenkins.plugins:gitlab-branch-source:\u003c 688.v5fa.

GHSA-8r93-59cf-358fMediumCVSS 4.3

CSRF vulnerability in Jenkins GitLab Branch Source Plugin

Vendor

GitHub Security Advisories

Published

January 24, 2024

Last Modified

January 31, 2024

🔗 CVE IDs covered (1)

CVE-2024-23902 →

📋 Description

Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier does not require POST requests for a form validation endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to connect to an attacker-specified URL.

GitLab Branch Source Plugin 688.v5fa_356ee8520 requires POST requests for the affected form validation endpoint.

🎯 Affected products1

maven/io.jenkins.plugins:gitlab-branch-source:< 688.v5fa

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2024-23902
https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3251
http://www.openwall.com/lists/oss-security/2024/01/24/6
https://github.com/jenkinsci/gitlab-branch-source-plugin/commit/5fa356ee852091af900498db07259afe78d7aad2
https://github.com/advisories/GHSA-8r93-59cf-358f