Gitlab Authentication (Jenkins) - vulnerabilities (CVEs)

4 CVEs, 0 in the last 30 days, 65 known versions, newest CVE from 2023-07-26. Vendor: Jenkins.

CVEs of Gitlab Authentication

• CVE-2023-39153 - CVSS 5.4 (medium), 2023-07-26: A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick users into logging in…
• CVE-2022-27206 - CVSS 6.5 (medium), 2022-03-15: Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller…
• CVE-2022-25196 - CVSS 5.4 (medium), 2022-02-15: Jenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authentication process…
• CVE-2020-2228 - CVSS 8.8 (high), 2020-07-15: Jenkins Gitlab Authentication Plugin 1.5 and earlier does not perform group authorization checks properly, resulting in a privilege escalation vulnerability.