GHSA-fw9h-cxx9-gfq3

    Dashboard / Vulnerabilities / GHSA-fw9h-cxx9-gfq3

    GHSA-fw9h-cxx9-gfq3

    Published: 24 Jan 2024Last Modified: 16 Feb 2024

    Summary: Shared projects are unconditionally discovered by Jenkins GitLab Branch Source Plugin

    Details: GitLab allows sharing a project with another group. Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier unconditionally discovers projects that are shared with the configured owner group. This allows attackers to configure and share a project, resulting in a crafted Pipeline being built by Jenkins after the next scan of the group’s projects. In GitLab Branch Source Plugin 688.v5fa_356ee8520, the default strategy for discovering projects does not discover projects shared with the configured owner group. To discover projects shared with the configured owner group, use the new trait "Discover shared projects".

    References: https://nvd.nist.gov/vuln/detail/CVE-2024-23901, https://github.com/jenkinsci/gitlab-branch-source-plugin/commit/969ccece8e2185ecdb7c342b27173af1ab17045c, https://github.com/jenkinsci/gitlab-branch-source-plugin, https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3040, http://www.openwall.com/lists/oss-security/2024/01/24/6

    Affected packages

    Package

    Name: io.jenkins.plugins:gitlab-branch-source

    Purl: pkg:maven/io.jenkins.plugins/gitlab-branch-source

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -688.v5fa

    Affected versions

    0.0.5-alpha-2
    0.0.7-beta
    0.0.8-beta

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-fw9h-cxx9-gfq3 | CVE-DB