CVE-2023-39153

Name of the Vulnerable Software and Affected Versions Jenkins GitLab Authentication Plugin versions 1.17.1 and earlier

Description A cross-site request forgery (CSRF) vulnerability allows attackers to trick users into logging in to the attacker's account. This issue arises because the plugin does not implement a state parameter in its OAuth flow, which is a unique and non-guessable value associated with each authentication request.

Recommendations For Jenkins GitLab Authentication Plugin versions 1.17.1 and earlier, update to version 1.18 or later, which implements a state parameter in its OAuth flow.