CVE-2022-25196

2022-02-1517:15:10

Google

osv.dev

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.0%

JSON

Jenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authentication process starts, allowing attackers with access to Jenkins to craft a URL that will redirect users to an attacker-specified URL after logging in.

CPENameOperatorVersion
gitlab-oauth-plugineqgitlab-oauth-1.5
gitlab-oauth-plugineqgithub-oauth-0.19
gitlab-oauth-plugineq1.0.5
gitlab-oauth-plugineqgitlab-oauth-1.9
gitlab-oauth-plugineqgithub-oauth-0.16
gitlab-oauth-plugineqgithub-oauth-0.13.1
gitlab-oauth-plugineq1.0.6
gitlab-oauth-plugineqgithub-oauth-0.21
gitlab-oauth-plugineqgithub-oauth-0.21.1
gitlab-oauth-plugineqgitlab-oauth-1.8

Name	Operator	Version
gitlab-oauth-plugin	eq	gitlab-oauth-1.5
gitlab-oauth-plugin	eq	github-oauth-0.19
gitlab-oauth-plugin	eq	1.0.5
gitlab-oauth-plugin	eq	gitlab-oauth-1.9
gitlab-oauth-plugin	eq	github-oauth-0.16
gitlab-oauth-plugin	eq	github-oauth-0.13.1
gitlab-oauth-plugin	eq	1.0.6
gitlab-oauth-plugin	eq	github-oauth-0.21
gitlab-oauth-plugin	eq	github-oauth-0.21.1
gitlab-oauth-plugin	eq	gitlab-oauth-1.8