Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.jenkins-ci.plugins:gitlab-oauth

6 known vulnerabilities, with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6
Registry
Maven Central

Advisories 6

  • A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick…

    Affected: fixed in 1.18.

  • Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the…

    Affected: fixed in 1.14.

  • Jenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the…

    Affected: through 1.13.

  • Jenkins Gitlab Authentication Plugin 1.5 and earlier does not perform group authorization checks properly, resulting in a privilege…

    Affected: fixed in 1.6.

  • An open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows attackers to…

    Affected: fixed in 1.5.

  • A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized…

    Affected: fixed in 1.5.