GCVE - cpe:2.3:a:jenkins_project:jenkins_gitlab_authentication

Approved changes feed: RSS · Atom

cpe:2.3:a:jenkins_project:jenkins_gitlab_authentication_plugin:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Jenkins Project (`860cd631-1316-551d-89a3-5aa9a0d4f462`)
Product	Jenkins Gitlab Authentication Plugin (`2fcc1f15-1913-5c12-bd8b-c7d7a723d3c2`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-39153`	vulnerable	2026-06-08 06:09:35.820982	Details available A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick users into logging in to the attacker's account. Published: 2023-07-26T13:54:53.558Z Updated: 2024-10-23T14:47:07.364Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2023-07-26/#SECURITY-2696 http://www.openwall.com/lists/oss-security/2023/07/26/2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-27206`	vulnerable	2026-06-08 05:41:54.999674	Details available Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. Published: 2022-03-15T16:45:53.000Z Updated: 2024-08-03T05:25:32.328Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-1891 http://www.openwall.com/lists/oss-security/2022/03/15/2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-25196`	vulnerable	2026-06-08 05:41:45.521696	Details available Jenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authentication process starts, allowing attackers with access to Jenkins to craft a URL that will redirect users to an attacker-specified URL after logging in. Published: 2022-02-15T16:11:26.000Z Updated: 2024-08-03T04:36:05.841Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-1833 http://www.openwall.com/lists/oss-security/2022/02/15/2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-2228`	vulnerable	2026-06-08 05:24:59.123531	Details available Jenkins Gitlab Authentication Plugin 1.5 and earlier does not perform group authorization checks properly, resulting in a privilege escalation vulnerability. Published: 2020-07-15T17:00:29.000Z Updated: 2024-08-04T07:01:41.088Z Open on db.gcve.eu Reference links https://jenkins.io/security/advisory/2020-07-15/#SECURITY-1792 http://www.openwall.com/lists/oss-security/2020/07/15/5	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-10372`	vulnerable	2026-06-08 05:12:23.229643	Details available An open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows attackers to redirect users to a URL outside Jenkins after successful login. Published: 2019-08-07T14:20:24.000Z Updated: 2024-08-04T22:17:20.596Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2019/08/07/1 https://jenkins.io/security/advisory/2019-08-07/#SECURITY-796	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-10371`	vulnerable	2026-06-08 05:12:23.228616	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Jenkins Gitlab Authentication Plugin

PURL mappings

Vulnerability references

Contribute