CVE-2023-39153
UNKNOWN
Published 2023-07-26T13:54:53.558Z
Actions:
Expert Analysis
Professional remediation guidance
Get tailored security recommendations from our analyst team for CVE-2023-39153. We'll provide specific mitigation strategies based on your environment and risk profile.
No CVSS data available
Description
A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick users into logging in to the attacker's account.
Available Exploits
No exploits available for this CVE.
Related News
No news articles found for this CVE.
Affected Products
Affected Versions:
GitHub Security Advisories
Community-driven vulnerability intelligence from GitHub
Advisory Details
GitLab Authentication Plugin 1.17.1 and earlier does not implement a state parameter in its OAuth flow, a unique and non-guessable value associated with each authentication request.
This vulnerability allows attackers to trick users into logging in to the attacker’s account.
GitLab Authentication Plugin 1.18 implements a state parameter in its OAuth flow.
Affected Packages
Maven
org.jenkins-ci.plugins:gitlab-oauth
ECOSYSTEM:
≥0
<1.18
CVSS Scoring
CVSS Score
5.0
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
References
Advisory provided by GitHub Security Advisory Database. Published: July 26, 2023, Modified: July 31, 2023
References
Published: 2023-07-26T13:54:53.558Z
Last Modified: 2024-10-23T14:47:07.364Z
Copied to clipboard!