GHSA-8r93-59cf-358f

    Dashboard / Vulnerabilities / GHSA-8r93-59cf-358f

    GHSA-8r93-59cf-358f

    Published: 24 Jan 2024Last Modified: 16 Feb 2024

    Summary: CSRF vulnerability in Jenkins GitLab Branch Source Plugin

    Details: Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier does not require POST requests for a form validation endpoint, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to connect to an attacker-specified URL. GitLab Branch Source Plugin 688.v5fa_356ee8520 requires POST requests for the affected form validation endpoint.

    References: https://nvd.nist.gov/vuln/detail/CVE-2024-23902, https://github.com/jenkinsci/gitlab-branch-source-plugin/commit/5fa356ee852091af900498db07259afe78d7aad2, https://github.com/jenkinsci/gitlab-branch-source-plugin, https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3251, http://www.openwall.com/lists/oss-security/2024/01/24/6

    Affected packages

    Package

    Name: io.jenkins.plugins:gitlab-branch-source

    Purl: pkg:maven/io.jenkins.plugins/gitlab-branch-source

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -688.v5fa

    Affected versions

    0.0.5-alpha-2
    0.0.7-beta
    0.0.8-beta

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-8r93-59cf-358f | CVE-DB