medium6.1
CVE-2019-10372
Jenkins Gitlab Authentication Plugin Open Redirect vulnerability
Impact
GitLab Authentication Plugin records the HTTP `Referer` header when the authentication process starts and redirects users to that URL when the user has finished logging in. This implements an open redirect, allowing malicious sites to implement a phishing attack, with users expecting they have just logged in to Jenkins.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:gitlab-oauth | <= 1.4 | 1.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Gitlab Oauth | through 1.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2019/08/07/1
- https://jenkins.io/security/advisory/2019-08-07/#SECURITY-796
- https://github.com/advisories/GHSA-pg59-2w33-8vmc
- https://nvd.nist.gov/vuln/detail/CVE-2019-10372
- https://github.com/jenkinsci/gitlab-oauth-plugin/commit/10059a4d4e121e0c3b13f6e6f74843565bb0b49a