CVE-2019-10372
mediumpriority · track · 24EPSS 0.010 · 62 %ileEUUSEPSS · scored 2026-10-28
An open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows attackers to redirect users to a URL outside Jenkins after successful login.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-pg59-2w33-8vmcJenkins Gitlab Authentication Plugin Open Redirect vulnerability2022-05-24ghsa · osvUS
GitLab Authentication Plugin records the HTTP `Referer` header when the authentication process starts and redirects users to that URL when the user has finished logging in. This implements an open redirect, allowing malicious sites to implement a phishing attack, with users expecting they have just logged in to Jenkins.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2019/08/07/1cnnvd
- https://jenkins.io/security/advisory/2019-08-07/#SECURITY-796cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2019-10372cnnvd
- https://vigilance.fr/vulnerability/Jenkins-Plugins-multiple-vulnerabilities-29976cnnvd
- http://www.openwall.com/lists/oss-security/2019/08/07/1enisa_euvd
- https://jenkins.io/security/advisory/2019-08-07/#SECURITY-796enisa_euvd
- http://www.openwall.com/lists/oss-security/2019/08/07/1Mailing ListThird Party Advisorynvd
- https://jenkins.io/security/advisory/2019-08-07/#SECURITY-796Vendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan