CVE-2019-10300: Jenkins GitLab Plugin Cross-Site Request Forgery vulnerability
Summary
CVE-2019-10300: Jenkins GitLab Plugin Cross-Site Request Forgery vulnerability. Affects org.jenkins-ci.plugins:gitlab-plugin versions < 1.5.12. Fixed in 1.5.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins GitLab Plugin is a Maven package that integrates Jenkins with GitLab, allowing users to trigger Jenkins jobs when changes are pushed to a GitLab repository. It provides functionality for managing GitLab webhooks, authentication, and project configuration. This plugin is widely used in software development workflows that utilize Jenkins and GitLab.
Vulnerability Detail
The Jenkins GitLab Plugin was found to have a Cross-Site Request Forgery (CSRF) vulnerability. This vulnerability allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method. By exploiting this vulnerability, an attacker could capture credentials stored in Jenkins. Additionally, the form validation method used in the plugin did not require POST requests, making it susceptible to CSRF attacks.
How To Fix
Latest published version: 1.2158.v49db_f64b_fc28 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.12
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest version of the Jenkins GitLab Plugin.
Conclusion
The Jenkins GitLab Plugin version 1.5.11 and below are vulnerable to a Cross-Site Request Forgery vulnerability that allows attackers to capture credentials stored in Jenkins. Users should update to version 1.5.12 or higher to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:gitlab-plugin →
FAQ
This vulnerability allows an attacker to capture credentials stored in Jenkins, potentially leading to unauthorized access to sensitive information or systems.
Users of the Jenkins GitLab Plugin versions 1.5.11 and below are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of this advisory.
Yes, the CVSS score for this vulnerability is 8.0 (High).
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-j365-62px-vjjv.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:gitlab-plugin.
