Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Advisory: Jenkins GitLab Branch Source Plugin — Jenkins Security Advisory 2024-01-24 Clear all filters
TI-2024-15891 CVE-2024-23903 · GHSA-f67f-2j6r-m4c9

Incorrect comparison in Jenkins GitLab Branch Source Plugin

Priority LOW 31

Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.005 Published 2024-01-24 Fixed in 688.v5fa CWE-697
TI-2024-15890 CVE-2024-23902 · GHSA-8r93-59cf-358f

Cross-site request forgery in Jenkins GitLab Branch Source Plugin

Priority LOW 20

A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier allows attackers to connect to an attacker-specified URL.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00323 Published 2024-01-24 Fixed in 688.v5fa CWE-352
TI-2024-15889 CVE-2024-23901 · GHSA-fw9h-cxx9-gfq3

Information disclosure in Jenkins GitLab Branch Source Plugin

Priority LOW 35

Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier unconditionally discovers projects that are shared with the configured owner group, allowing attackers to configure and share a project, resulting in a…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00458 Published 2024-01-24 Fixed in 688.v5fa CWE-200