CVE-2019-10372
published 2019-08-07CVE-2019-10372: An open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows attackers to redirect users to a URL…
PriorityP424medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.97%
61.4th percentile
An open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows attackers to redirect users to a URL outside Jenkins after successful login.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gitlab | gitlab | — | — |
| jenkins | avatar_plugin | — | — |
| jenkins | build_pipeline_plugin | — | — |
| jenkins | codefresh_integration_plugin | — | — |
| jenkins | configuration_as_code_plugin | — | — |
| jenkins | file_system_scm_plugin | — | — |
| jenkins | gitlab_authentication_plugin | — | — |
| jenkins | gitlab_oauth | <= 1.4 | — |
| jenkins | google_cloud_messaging_notification_plugin | — | — |
| jenkins | jclouds_plugin | — | — |
| jenkins | jenkins_instance_with_this_plugin | — | — |
| jenkins | mask_passwords_plugin | — | — |
| jenkins | pegdown_formatter_plugin | — | — |
| jenkins | relution_enterprise_appstore_publisher_plugin | — | — |
| jenkins | simple_travis_pipeline_runner_plugin | — | — |
| jenkins | testlink_plugin | — | — |
| jenkins | vmware_lab_manager_slaves_plugin | — | — |
| jenkins | wall_display_master_project_plugin | — | — |
| jenkins | xl_testview_plugin | — | — |
| jenkins_project | jenkins_gitlab_authentication_plugin | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Jenkins Gitlab Authentication Plugin Open Redirect vulnerability
ghsa·2022-05-24
CVE-2019-10372 [MEDIUM] CWE-601 Jenkins Gitlab Authentication Plugin Open Redirect vulnerability
Jenkins Gitlab Authentication Plugin Open Redirect vulnerability
GitLab Authentication Plugin records the HTTP `Referer` header when the authentication process starts and redirects users to that URL when the user has finished logging in.
This implements an open redirect, allowing malicious sites to implement a phishing attack, with users expecting they have just logged in to Jenkins.
OSV
Jenkins Gitlab Authentication Plugin Open Redirect vulnerability
osv·2022-05-24
CVE-2019-10372 [MEDIUM] Jenkins Gitlab Authentication Plugin Open Redirect vulnerability
Jenkins Gitlab Authentication Plugin Open Redirect vulnerability
GitLab Authentication Plugin records the HTTP `Referer` header when the authentication process starts and redirects users to that URL when the user has finished logging in.
This implements an open redirect, allowing malicious sites to implement a phishing attack, with users expecting they have just logged in to Jenkins.
Jenkins
Jenkins Security Advisory 2019-08-07
vendor_jenkins·2019-08-07·CVSS 5.5
CVE-2019-10367 [MEDIUM] Jenkins Security Advisory 2019-08-07
Title: Jenkins Security Advisory 2019-08-07
Jenkins Security Advisory 2019-08-07
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Avatar
Plugin
Build Pipeline
Plugin
Codefresh Integration
Plugin
Configuration as Code
Plugin
eggplant-plugin
Plugin
File System SCM
Plugin
Google Cloud Messaging Noti
GitLab
CVE-2019-10372: An open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows attackers to redirect users
vendor_gitlab·2019-08-07·CVSS 6.1
CVE-2019-10372 [MEDIUM] CWE-601 CVE-2019-10372: An open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows attackers to redirect users
CVE-2019-10372: An open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows attackers to redirect users to a URL outside Jenkins after successful login.
No detection rules found.
No writeups or analysis indexed.
2019-08-07
Published