What is GHSA-mvq8-hgxh-4v2g?

GHSA-mvq8-hgxh-4v2g is a security advisory published by GitHub Security Advisories with Medium severity. Open redirect vulnerability in Jenkins GitLab Authentication Plugin

Which CVE IDs does GHSA-mvq8-hgxh-4v2g cover?

GHSA-mvq8-hgxh-4v2g covers the following CVE IDs: CVE-2022-25196. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mvq8-hgxh-4v2g?

GHSA-mvq8-hgxh-4v2g has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-mvq8-hgxh-4v2g?

GHSA-mvq8-hgxh-4v2g affects 1 product, including: maven/org.jenkins-ci.plugins:gitlab-oauth:\u003c= 1.13.

GHSA-mvq8-hgxh-4v2gMediumCVSS 5.4

Open redirect vulnerability in Jenkins GitLab Authentication Plugin

Vendor

GitHub Security Advisories

Published

February 16, 2022

Last Modified

October 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-25196 →

📋 Description

Jenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authentication process starts, allowing attackers with access to Jenkins to craft a URL that will redirect users to an attacker-specified URL after logging in.

This issue is caused by an incomplete fix of SECURITY-796.

🎯 Affected products1

maven/org.jenkins-ci.plugins:gitlab-oauth:<= 1.13

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2022-25196
https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-1833
http://www.openwall.com/lists/oss-security/2022/02/15/2
https://www.jenkins.io/security/advisory/2019-08-07/#SECURITY-796
https://github.com/advisories/GHSA-mvq8-hgxh-4v2g