Description

An open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows attackers to redirect users to a URL outside Jenkins after successful login.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/08/07/1

https://jenkins.io/security/advisory/2019-08-07/#SECURITY-796

Related Vulnerabilities

CVE-2022-45143 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core

CVE-2016-4464 Vulnerability in maven package org.apache.cxf.fediz:plugin

CVE-2019-20343 Vulnerability in maven package org.codehaus.mojo:exec-maven-plugin

CVE-2019-18212 Vulnerability in maven package org.lsp4xml:lsp4xml-extensions

CVE-2020-7768 Vulnerability in npm package @grpc/grpc-js

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Mailing List Third Party Advisory Vendor Advisory CWE-601