Jenkins Gitlab Authentication Plugin (Jenkins Project) - vulnerabilities (CVEs)

6 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2023-07-26. Vendor: Jenkins Project.

CVEs of Jenkins Gitlab Authentication Plugin

• CVE-2023-39153 - CVSS 5.4 (medium), 2023-07-26: A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick users into logging in…
• CVE-2022-27206 - CVSS 6.5 (medium), 2022-03-15: Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller…
• CVE-2022-25196 - CVSS 5.4 (medium), 2022-02-15: Jenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authentication process…
• CVE-2020-2228 - CVSS 8.8 (high), 2020-07-15: Jenkins Gitlab Authentication Plugin 1.5 and earlier does not perform group authorization checks properly, resulting in a privilege escalation vulnerability.
• CVE-2019-10372 - CVSS 6.1 (medium), 2019-08-07: An open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows attackers to redirect users to a URL…
• CVE-2019-10371 - CVSS 7.5 (high), 2019-08-07: A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attackers to…