PT-2019-11717 · Jenkins · Jenkins Gitlab Authentication Plugin+1

Taka_1690 + 1 · Published 2019-04-30 · Updated 2023-10-25 · CVE-2019-10315

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jenkins GitHub Authentication Plugin versions 0.31 and earlier

Description The issue concerns the management of the state parameter of OAuth to prevent CSRF. An attacker could catch the redirect URL provided during the authentication process using OAuth and send it to the victim. If the victim was already connected to Jenkins, their Jenkins account would be attached to the attacker’s GitHub account.

Recommendations For Jenkins GitHub Authentication Plugin versions 0.31 and earlier, update to a version that correctly manages the state parameter of OAuth to prevent CSRF. As a temporary workaround, consider restricting the use of OAuth authentication until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-10315

GHSA-PHWV-CRGP-9R69

Affected Products

Jenkins

Jenkins Gitlab Authentication Plugin

References · 7

• https://osv.dev/vulnerability/GHSA-phwv-crgp-9r69 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10315 · Security Note
• https://jenkins.io/security/advisory/2019-04-30/#SECURITY-443 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10315 · Vendor Advisory
• http://openwall.com/lists/oss-security/2019/04/30/5 · Note
• https://web.archive.org/web/20200227073756/http://securityfocus.com/bid/108159 · Note
• http://securityfocus.com/bid/108159 · Note