jenkins gitlab authentication vulnerabilities and exploits

(subscribe to this query)

Jenkins Gitlab Authentication Plugin 1.5 and previous versions does not perform group authorization checks properly, resulting in a privilege escalation vulnerability.

Jenkins Gitlab Authentication

A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and previous versions in GitLabSecurityRealm.java allows unauthorized malicious users to impersonate another user if they can control the pre-authentication session.

Jenkins Gitlab Oauth

Jenkins GitLab Authentication Plugin 1.13 and previous versions stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

Jenkins Gitlab Authentication

An open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and previous versions in GitLabSecurityRealm.java allows malicious users to redirect users to a URL outside Jenkins after successful login.

Jenkins Gitlab Oauth

A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and previous versions allows malicious users to trick users into logging in to the attacker's account.

Jenkins Gitlab Authentication

Jenkins GitLab Authentication Plugin 1.13 and previous versions records the HTTP Referer header as part of the URL query parameters when the authentication process starts, allowing attackers with access to Jenkins to craft a URL that will redirect users to an attacker-specified U...

Jenkins Gitlab Authentication

Official Writeup - Simple CTF 2.0 Created: April 23, 2024 7:50 PM Today I completed an other room on TryHackMe with a simple file-upload vulnerability which I built. I have tried for dancing around this whole CTF machine and getting a lot of walls of challenges in the end it co...

1 Github repository

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook