GHSA-pg59-2w33-8vmcMediumCVSS 6.1
Jenkins Gitlab Authentication Plugin Open Redirect vulnerability
🔗 CVE IDs covered (1)
📋 Description
GitLab Authentication Plugin records the HTTP Referer header when the authentication process starts and redirects users to that URL when the user has finished logging in.
This implements an open redirect, allowing malicious sites to implement a phishing attack, with users expecting they have just logged in to Jenkins.
🎯 Affected products1
- maven/org.jenkins-ci.plugins:gitlab-oauth:<= 1.4
🔗 References (5)
- https://nvd.nist.gov/vuln/detail/CVE-2019-10372
- https://jenkins.io/security/advisory/2019-08-07/#SECURITY-796
- http://www.openwall.com/lists/oss-security/2019/08/07/1
- https://github.com/jenkinsci/gitlab-oauth-plugin/commit/10059a4d4e121e0c3b13f6e6f74843565bb0b49a
- https://github.com/advisories/GHSA-pg59-2w33-8vmc