| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:gitlab-oauth | < 1.5 | 1.5 |
| gitlab oauth | ≤ 1.4 |
GitLab Authentication Plugin records the HTTP Referer header when the authentication process starts and redirects users to that URL when the user has finished logging in.
This implements an open redirect, allowing malicious sites to implement a phishing attack, with users expecting they have just logged in to Jenkins.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free