~ / search / GHSA-p756-66w2-35g7

GHSA-p756-66w2-35g7

Jenkins Assembla Auth Plugin vulnerable to cross-site request forgery

Source: GitHub Advisory Database (reviewed) High CVE-2023-37961

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:assembla-auth <= 1.14 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Assembla Auth Plugin 1.14 and earlier does not implement a state parameter in its OAuth flow, a unique and non-guessable value associated with each authentication request. This vulnerability allows attackers to trick users into logging in to the attacker’s account.

References

External links from the advisory. They lead to third-party sites.