Jenkins GitLab OAuth vulnerabilities

2 CVEs affecting Jenkins GitLab OAuth, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-10372, published 2019-08-07.

More from Jenkins.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-10371, published 2019-08-07. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attackers to impersonate another user if they can control the…
• CVE-2019-10372, published 2019-08-07. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. An open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows attackers to redirect users to a URL outside Jenkins after successful login.