Skip to content
Sign in
6.5 Medium

CVE-2024-23901 Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier unconditionally discovers projects that are shared…

Description

Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier unconditionally discovers projects that are shared with the configured owner group, allowing attackers to configure and share a project, resulting in a crafted Pipeline being built by Jenkins during the next scan of the group.

Affected products and versions

Product Affected versions Fixed in
Jenkins GitLab Branch Source Plugin Versions not published

Other CVEs of Jenkins GitLab Branch Source Plugin

The 3 CVEs of Jenkins GitLab Branch Source Plugin →
CVE-2024-23902 A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier… 4.3 Medium CVE-2024-23903 Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier uses a non-constant time comparison function when… 5.3 Medium
Track this CVE