GHSA-pg59-2w33-8vmc
Jenkins Gitlab Authentication Plugin Open Redirect vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins:gitlab-oauth | < 1.5 | 1.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
GitLab Authentication Plugin records the HTTP `Referer` header when the authentication process starts and redirects users to that URL when the user has finished logging in.
This implements an open redirect, allowing malicious sites to implement a phishing attack, with users expecting they have just logged in to Jenkins.
References
External links from the advisory. They lead to third-party sites.