CVE-2024-23902

Name of the Vulnerable Software and Affected Versions Jenkins GitLab Branch Source Plugin versions 684.vea fa 7c1e2fe3 and earlier

Description The issue is related to a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to connect to an attacker-specified URL. The vulnerability is caused by the plugin not requiring POST requests for a form validation endpoint.

Recommendations For Jenkins GitLab Branch Source Plugin versions 684.vea fa 7c1e2fe3 and earlier, update to a version that requires POST requests for the affected form validation endpoint, such as GitLab Branch Source Plugin 688.v5fa 356ee8520. As a temporary workaround, consider restricting access to the form validation endpoint to minimize the risk of exploitation.