Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
GitLab Authentication Plugin 1.17.1 and earlier does not implement a state parameter in its OAuth flow, a unique and non-guessable value associated with each authentication request. This vulnerability allows attackers to trick users into logging in to the attacker’s account. GitLab Authentication Plugin 1.18 implements a state parameter in its OAuth flow.
Recommended action: Upgrade to 1.18 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
GitLab Authentication Plugin 1.5 and earlier does not differentiate between user names and hierarchical group names when performing authorization. This allows an attacker with permissions to create groups in GitLab to gain the privileges granted to another user or group. GitLab Authentication Plugin 1.6 performs user name and group name authorization checks using the appropriate GitLab APIs.
Recommended action: Upgrade to 1.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
GitLab Authentication Plugin records the HTTP Referer header when the authentication process starts and redirects users to that URL when the user has finished logging in. This implements an open redirect, allowing malicious sites to implement a phishing attack, with users expecting they have just logged in to Jenkins.
Recommended action: Upgrade to 1.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.
Recommended action: Upgrade to 1.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. This client secret can be viewed by users with access to the Jenkins controller file system.
Recommended action: Upgrade to 1.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.