High · 8.1 CVE-2020-2228 EUVD-2022-5014GHSA-qq38-mxpq-rrpj

Improper authorization of users and groups with the same base name in Jenkins GitLab Authentication Plugin

Published Jul 15, 2020 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Gitlab Authentication Plugin Package: org.jenkins-ci.plugins:gitlab-oauth Category: Web / CMS Ecosystem: Maven

Description

Jenkins Gitlab Authentication Plugin 1.5 and earlier does not perform group authorization checks properly, resulting in a privilege escalation vulnerability.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins Gitlab Authentication Plugin	unspecified – ≤ 1.5	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jenkins-ci.plugins:gitlab-oauth	< 1.6	1.6	GHSA-qq38-mxpq-rrpj

References

https://jenkins.io/security/advisory/2020-07-15/#SECURITY-1792
[oss-security] 20200715 Multiple vulnerabilities in Jenkins and Jenkins plugins mailing-list