CVE-2019-10372: Jenkins Gitlab Authentication Plugin Open Redirect vulnerability
Summary
CVE-2019-10372: Jenkins Gitlab Authentication Plugin Open Redirect vulnerability. Affects org.jenkins-ci.plugins:gitlab-oauth versions < 1.5. Fixed in 1.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The GitLab Authentication Plugin is a plugin for the Jenkins automation server that allows users to authenticate using their GitLab credentials. It records the HTTP Referer header during the authentication process and redirects users to that URL after logging in. This feature is intended to provide a seamless user experience. However, a vulnerability exists in the plugin that allows malicious sites to exploit this redirect functionality for phishing attacks.
Vulnerability Detail
The vulnerability in the Jenkins GitLab Authentication Plugin allows malicious sites to implement an open redirect attack. When users log in to Jenkins using their GitLab credentials, they are redirected to the URL specified in the Referer header. This can be manipulated by attackers to redirect users to a phishing site instead, making them believe they have successfully logged in to Jenkins. The impact of this vulnerability is that it can lead to credential theft and unauthorized access to Jenkins resources.
How To Fix
Latest published version: 1.30 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can take general precautions to minimize the risk of falling victim to phishing attacks. These include being cautious of clicking on suspicious links, verifying the authenticity of login pages, and using strong, unique passwords for all accounts.
Conclusion
The Jenkins GitLab Authentication Plugin is vulnerable to an open redirect attack, allowing malicious sites to redirect users to phishing sites. As of now, there is no fix available for this vulnerability. It is recommended to monitor official channels for updates and apply patches once they are released. To protect yourself, be cautious of clicking on suspicious links, verify login page authenticity, and use strong, unique passwords. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:gitlab-oauth →
FAQ
The vulnerability allows attackers to redirect users to phishing sites, potentially leading to credential theft and unauthorized access to Jenkins resources.
As of the publication of this advisory, there is no fix available. It is recommended to monitor official channels for updates and apply patches once they are released.
To protect yourself from phishing attacks, be cautious of clicking on suspicious links, verify the authenticity of login pages, and use strong, unique passwords for all accounts.
While the vulnerability exists, it is recommended to exercise caution when using the GitLab Authentication Plugin. Monitor official channels for updates and apply patches once they are released.
For more information about this vulnerability, you can refer to the official Jenkins website and plugin repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:gitlab-oauth.
