Open Redirect Vulnerability in Jenkins Gitlab Authentication Plugin
CVE-2019-10372

6.1MEDIUM

Key Information:

Vendor

Jenkins
Status
Jenkins Gitlab Authentication Plugin
Vendor
CVE Published:
7 August 2019

What is CVE-2019-10372?

The Jenkins Gitlab Authentication Plugin prior to version 1.4 contains an open redirect flaw within the GitLabSecurityRealm.java file. This vulnerability enables attackers to manipulate URLs and redirect authenticated users to malicious external sites following a successful login. Exploitation of this vulnerability poses a significant security risk, as it could facilitate phishing attacks and other forms of unauthorized access. Users are advised to update the plugin to the latest version to mitigate the risks associated with this flaw.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Jenkins Gitlab Authentication Plugin 1.4 and earlier

References

http://www.openwall.com/lists/oss-security/2019/08/07/1
mailing-listx_refsource_MLIST
https://jenkins.io/security/advisory/2019-08-07/#SECURITY...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.