Skip to content
OpenAdvisories
Medium · 4.3 CVE-2019-10315 EUVD-2022-4779GHSA-phwv-crgp-9r69

Jenkins GitHub Authentication Plugin Cross-Site Request Forgery vulnerability

Published Apr 30, 2019 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins GitHub Authentication Plugin Package: org.jenkins-ci.plugins:github-oauth Category: Web / CMS Ecosystem: Maven

Description

Jenkins GitHub Authentication Plugin 0.31 and earlier did not use the state parameter of OAuth to prevent CSRF.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins GitHub Authentication Plugin 0.31 and earlier —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:github-oauth < 0.32 0.32 GHSA-phwv-crgp-9r69

References