Cross-site request forgery In org.jenkins-ci.plugins:gitlab-oauth
Description
CSRF vulnerability in GitLab Authentication Plugin GitLab Authentication Plugin 1.17.1 and earlier does not implement a state parameter in its OAuth flow, a unique and non-guessable value associated with each authentication request.
This vulnerability allows attackers to trick users into logging in to the attacker’s account.
GitLab Authentication Plugin 1.18 implements a state parameter in its OAuth flow.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 1.18 |
Aliases
1. 2. 3. 4.
References
1. 2. 3. 4.