VulnerabilityModified
CVE-2022-25196
Jenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authentication process starts, allowing attackers with access to Jenkins to craft a URL that will redirect users to an…
MEDIUM 5.4EPSS 0.72%
Does this matter?
Lower severity and a low EPSS score (0.72%). Track it; it rarely justifies an emergency change on its own.
Description
Jenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authentication process starts, allowing attackers with access to Jenkins to craft a URL that will redirect users to an attacker-specified URL after logging in.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.72% probability · 52th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-601
- Affected
- jenkins/gitlab authentication
- Source
- jenkinsci-cert@googlegroups.com
References
- http://www.openwall.com/lists/oss-security/2022/02/15/2Mailing List, Third Party Advisory
- https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-1833Issue Tracking, Patch, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2022/02/15/2Mailing List, Third Party Advisory
- https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-1833Issue Tracking, Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.