Jenkins project Vulnerabilities and Affected Products
Vulnerabilities associated with Jenkins GitLab Authentication Plugin.
Products
Clear product- Jenkins124 vulnerabilities
- Jenkins Script Security Plugin29 vulnerabilities
- Jenkins Active Directory Plugin11 vulnerabilities
- Jenkins Pipeline: Groovy Plugin11 vulnerabilities
- Jenkins Email Extension Plugin9 vulnerabilities
- Jenkins Build Failure Analyzer Plugin8 vulnerabilities
- Jenkins NS-ND Integration Performance Publisher Plugin8 vulnerabilities
- Jenkins OpenId Connect Authentication Plugin8 vulnerabilities
- Jenkins Pipeline: Shared Groovy Libraries Plugin8 vulnerabilities
- Jenkins Amazon EC2 Plugin7 vulnerabilities
- Jenkins Configuration as Code Plugin7 vulnerabilities
- Jenkins Git Plugin7 vulnerabilities
- Jenkins Job Configuration History Plugin7 vulnerabilities
- Jenkins OpenShift Deployer Plugin7 vulnerabilities
- Jenkins Rundeck Plugin7 vulnerabilities
- Jenkins SAML Single Sign On(SSO) Plugin7 vulnerabilities
- Jenkins Artifactory Plugin6 vulnerabilities
- Jenkins Azure VM Agents Plugin6 vulnerabilities
- Jenkins Config File Provider Plugin6 vulnerabilities
- Jenkins Credentials Binding Plugin6 vulnerabilities
- Jenkins Deployment Dashboard Plugin6 vulnerabilities
- Jenkins ElectricFlow Plugin6 vulnerabilities
- Jenkins Git Parameter Plugin6 vulnerabilities
- Jenkins GitLab Authentication Plugin6 vulnerabilities
- Jenkins GitLab Plugin6 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2023-39153MEDIUM | CSRF vulnerability in GitLab Authentication PluginA cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick users into logging in to the attacker's account. CWE-352Jul 26, 2023 | CVSS5.4v3.1 | EPSS0.696% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-27206MEDIUM | Client Secret stored in plain text by Jenkins GitLab Authentication PluginJenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. | CVSS6.5v3.1 | EPSS1.02% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-25196MEDIUM | Open redirect vulnerability in Jenkins GitLab Authentication PluginJenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authentication process starts, allowing attackers with access to Jenkins to craft a URL that will redirect users to an attacker-specified URL after logging in. CWE-601Feb 15, 2022 | CVSS5.4v3.1 | EPSS0.724% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-2228HIGH | Improper authorization of users and groups with the same base name in Jenkins GitLab Authentication PluginJenkins Gitlab Authentication Plugin 1.5 and earlier does not perform group authorization checks properly, resulting in a privilege escalation vulnerability. CWE-863Jul 15, 2020 | CVSS8.8v3.1 | EPSS1.43% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2019-10372MEDIUM | Jenkins Gitlab Authentication Plugin Open Redirect vulnerabilityAn open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows attackers to redirect users to a URL outside Jenkins after successful login. CWE-601Aug 7, 2019 | CVSS6.1v3.1 | EPSS0.965% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2019-10371HIGH | Jenkins Gitlab Authentication Plugin vulnerable to Session FixationA session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attackers to impersonate another user if they can control the pre-authentication session. CWE-384Aug 7, 2019 | CVSS7.5v3.1 | EPSS1.31% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |