Client Secret stored in plain text by Jenkins GitLab Authentication Plugin

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-27206 · ADVISORY
• jenkinsci/gitlab-oauth-plugin · PACKAGE
• jenkinsci/gitlab-oauth-plugin release gitlab-oauth-1.14 · WEB
• jenkins.io/security/advisory/2022-03-15 · WEB
• openwall.com/lists/oss-security/2022/03/15/2 · WEB

org.jenkins-ci.plugins:gitlab-oauth のその他の脆弱性

• CVE-2023-39153中 5.4A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick users…
• CVE-2022-25196中 5.4Jenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authentic…
• CVE-2020-2228高 8.8Jenkins Gitlab Authentication Plugin 1.5 and earlier does not perform group authorization checks properly, resulting in a privilege escalati…
• CVE-2019-10372中 6.1An open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows attackers to redir…
• CVE-2019-10371高 7.5A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized att…