Description

Jenkins GitHub Authentication Plugin 0.31 and earlier did not use the state parameter of OAuth to prevent CSRF.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/04/30/5

http://www.securityfocus.com/bid/108159

https://jenkins.io/security/advisory/2019-04-30/#SECURITY-443

Related Vulnerabilities

CVE-2020-28500 Vulnerability in npm package lodash

CVE-2019-1003068 Vulnerability in maven package com.inkysea.vmware.vra:vmware-vrealize-automation-plugin

CVE-2023-46659 Vulnerability in maven package org.jenkins-ci.plugins:trac

CVE-2022-28220 Vulnerability in maven package org.apache.james:james-server-protocols-managesieve

CVE-2021-4040 Vulnerability in maven package org.apache.activemq:artemis-commons

Severity

Critical

Classification

CWE-352 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory Vendor Advisory