Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

Jenkins GitLab Authentication Plugin: Unauthorized Access via CSRF

CVE-2023-39153 · published 3 years ago
Summary

The Jenkins GitLab Authentication Plugin for Jenkins before version 1.17.2 is vulnerable to a type of attack that can trick users into logging in to an attacker's account. This could allow unauthorized access to the Jenkins server. To protect your server, update to version 1.17.2 or later.

What to do
  • Update jenkins-ci org.jenkins-ci.plugins:gitlab-oauth to version 1.18.
Affected software
Ecosystem VendorProductAffected versions
maven jenkins-ci org.jenkins-ci.plugins:gitlab-oauth < 1.18
Fix: upgrade to 1.18
– jenkins gitlab_authentication <= 1.17.1
cpe:2.3:a:jenkins:gitlab_authentication:*:*:*:*:*:jenkins:*:*
Original advisory text
A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick users into logging in to the attacker's account.
A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick users into logging in to the attacker's account.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published26 Jul 2023
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-cg6r-gqvc-r396 · GHSA
CVE-2023-39153 · NVD
Track software like this
Free during beta