GitHub Advisoryadvisory · Maven

GHSA-8r93-59cf-358f CSRF vulnerability in Jenkins GitLab Branch Source Plugin

MEDIUM Published 2024-01-24 Modified 2024-01-31 Official page ↗
Aliases
CVE-2024-23902
Ecosystem
Maven
Packages
io.jenkins.plugins:gitlab-branch-source
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-352
Reviewed
2024-01-24

Affected packages

• Maven io.jenkins.plugins:gitlab-branch-source: < 688.v5fa → fixed in 688.v5fa

Description

Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier does not require POST requests for a form validation endpoint, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to connect to an attacker-specified URL. GitLab Branch Source Plugin 688.v5fa_356ee8520 requires POST requests for the affected form validation endpoint.

Related

Alias · CVE (1)

  • CVE-2024-23902 A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier allows attackers… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References