Open Redirect Vulnerability in Jenkins Gitlab Authentication Plugin
CVE-2019-10372

6.1MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Gitlab Authentication Plugin
Vendor
CVE Published:
7 August 2019

Summary

The Jenkins Gitlab Authentication Plugin prior to version 1.4 contains an open redirect flaw within the GitLabSecurityRealm.java file. This vulnerability enables attackers to manipulate URLs and redirect authenticated users to malicious external sites following a successful login. Exploitation of this vulnerability poses a significant security risk, as it could facilitate phishing attacks and other forms of unauthorized access. Users are advised to update the plugin to the latest version to mitigate the risks associated with this flaw.

Affected Version(s)

Jenkins Gitlab Authentication Plugin 1.4 and earlier

References

http://www.openwall.com/lists/oss-security/2019/08/07/1
mailing-listx_refsource_MLIST
https://jenkins.io/security/advisory/2019-08-07/#SECURITY...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.