PT-2023-26810 · Jenkins · Jenkins Gitlab Authentication Plugin+1

Alvaro Muñoz + 1 · Published 2023-07-26 · Updated 2023-07-31 · CVE-2023-39153

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins GitLab Authentication Plugin versions 1.17.1 and earlier

Description A cross-site request forgery (CSRF) vulnerability allows attackers to trick users into logging in to the attacker's account. This issue arises because the plugin does not implement a state parameter in its OAuth flow, which is a unique and non-guessable value associated with each authentication request.

Recommendations For Jenkins GitLab Authentication Plugin versions 1.17.1 and earlier, update to version 1.18 or later, which implements a state parameter in its OAuth flow.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-39153

GHSA-CG6R-GQVC-R396

Affected Products

Jenkins

Jenkins Gitlab Authentication Plugin

References · 8

• https://jenkins.io/security/advisory/2023-07-26/#SECURITY-2696 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cg6r-gqvc-r396 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39153 · Security Note
• https://osv.dev/vulnerability/CVE-2023-39153 · Vendor Advisory
• https://github.com/jenkinsci/gitlab-oauth-plugin · Note
• https://github.com/jenkinsci/gitlab-oauth-plugin/commit/d5bdf767e6be2efa2e9d8f8cf99b98726bb5f29d · Note
• https://t.me/cvenotify/55236 · Telegram Post
• http://openwall.com/lists/oss-security/2023/07/26/2 · Note