CVE Database and Vulnerability Search
Search CVE and GHSA vulnerability records by identifier, title, vendor, product, package, or CWE. Filter by severity, CISA KEV, ransomware association, linked artifacts, and Nuclei templates; sort by publication date, CVSS, or EPSS.
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2023-39153MEDIUM | CSRF vulnerability in GitLab Authentication PluginA cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick users into logging in to the attacker's account. CWE-352Jul 26, 2023 | CVSS5.4v3.1 | EPSS0.696% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-27206MEDIUM | Client Secret stored in plain text by Jenkins GitLab Authentication PluginJenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. | CVSS6.5v3.1 | EPSS1.02% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-25196MEDIUM | Open redirect vulnerability in Jenkins GitLab Authentication PluginJenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authentication process starts, allowing attackers with access to Jenkins to craft a URL that will redirect users to an attacker-specified URL after logging in. CWE-601Feb 15, 2022 | CVSS5.4v3.1 | EPSS0.724% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-2228HIGH | Improper authorization of users and groups with the same base name in Jenkins GitLab Authentication PluginJenkins Gitlab Authentication Plugin 1.5 and earlier does not perform group authorization checks properly, resulting in a privilege escalation vulnerability. CWE-863Jul 15, 2020 | CVSS8.8v3.1 | EPSS1.43% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2019-10372MEDIUM | Jenkins Gitlab Authentication Plugin Open Redirect vulnerabilityAn open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows attackers to redirect users to a URL outside Jenkins after successful login. CWE-601Aug 7, 2019 | CVSS6.1v3.1 | EPSS0.965% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2019-10371HIGH | Jenkins Gitlab Authentication Plugin vulnerable to Session FixationA session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attackers to impersonate another user if they can control the pre-authentication session. CWE-384Aug 7, 2019 | CVSS7.5v3.1 | EPSS1.31% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |