GitHub Advisoryadvisory · Maven

GHSA-phwv-crgp-9r69 Jenkins GitHub Authentication Plugin Cross-Site Request Forgery vulnerability

MEDIUM Published 2022-05-24 Modified 2023-10-26 Official page ↗
Aliases
CVE-2019-10315
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:github-oauth
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Weaknesses
CWE-352
Reviewed
2023-10-26

Affected packages

• Maven org.jenkins-ci.plugins:github-oauth: < 0.32 → fixed in 0.32

Description

Jenkins GitHub Authentication Plugin did not manage the state parameter of OAuth to prevent CSRF. This allowed an attacker to catch the redirect URL provided during the authentication process using OAuth and send it to the victim. If the victim was already connected to Jenkins, their Jenkins account would be attached to the attacker’s GitHub account. The state parameter is now correctly managed.

Related

Alias · CVE (1)

  • CVE-2019-10315 Jenkins GitHub Authentication Plugin 0.31 and earlier did not use the state parameter of OAuth to prevent CSRF. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References