CVE-2019-10371: Jenkins Gitlab Authentication Plugin Session Fixation

org.jenkins-ci.plugins:gitlab-oauth Updated 02 Oct 2025

Summary

24/05/2022

Disclosed on

CVE-2019-10371

CVE

Yes i

Fix available

High

Severity

7.5

CVSS Score

CVE-2019-10371: Jenkins Gitlab Authentication Plugin vulnerable to Session Fixation. Affects org.jenkins-ci.plugins:gitlab-oauth versions < 1.5. Fixed in 1.5. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The Jenkins Gitlab Authentication Plugin is a plugin for the Jenkins automation server that allows users to authenticate using their GitLab credentials. It integrates Jenkins with GitLab, enabling users to log in to Jenkins using their GitLab accounts. The plugin is implemented as a Maven package with the package name 'org.jenkins-ci.plugins:plugin'. The vulnerability described in this report affects versions 0 to 1.4 of the plugin.

Vulnerability Detail

The GitLab Authentication Plugin in Jenkins does not invalidate the previous session and create a new one upon successful login. This allows attackers who can control or obtain another user's pre-login session ID to impersonate them. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level. The CWE ID associated with this vulnerability is CWE-384. As of the publication of this advisory, there is no fix available for this vulnerability.

How To Fix

Minimum fixed version

1.5

This is the first release that contains the fix.

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

There is no known workaround for this vulnerability at this time.

Conclusion

The Jenkins Gitlab Authentication Plugin is vulnerable to a session fixation issue that allows attackers to impersonate other users. As of now, there is no fix available for this vulnerability. Users of the plugin should stay updated with official announcements and apply the latest version as soon as it becomes available. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for org.jenkins-ci.plugins:gitlab-oauth →