PT-2019-11717 · Jenkins · Jenkins Gitlab Authentication Plugin+1

Taka_1690 + 1 · Publicado 2019-04-30 · Atualizado 2023-10-25 · CVE-2019-10315

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jenkins GitHub Authentication Plugin versions 0.31 and earlier

Description The issue concerns the management of the state parameter of OAuth to prevent CSRF. An attacker could catch the redirect URL provided during the authentication process using OAuth and send it to the victim. If the victim was already connected to Jenkins, their Jenkins account would be attached to the attacker’s GitHub account.

Recommendations For Jenkins GitHub Authentication Plugin versions 0.31 and earlier, update to a version that correctly manages the state parameter of OAuth to prevent CSRF. As a temporary workaround, consider restricting the use of OAuth authentication until a patch is available.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2019-10315

GHSA-PHWV-CRGP-9R69

Produtos afetados

Jenkins

Jenkins Gitlab Authentication Plugin

Referências · 7

• https://osv.dev/vulnerability/GHSA-phwv-crgp-9r69 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10315 · Nota de Segurança
• https://jenkins.io/security/advisory/2019-04-30/#SECURITY-443 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2019/04/30/5 · Nota
• https://osv.dev/vulnerability/CVE-2019-10315 · Aviso do Fabricante
• https://web.archive.org/web/20200227073756/http://securityfocus.com/bid/108159 · Nota
• http://securityfocus.com/bid/108159 · Nota