CVE-2019-10300

2019-04-1817:29:00

Google

osv.dev

6.2 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.5%

JSON

A cross-site request forgery vulnerability in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

CPENameOperatorVersion
gitlab-plugineqgitlab-plugin-1.0.8
gitlab-plugineqgitlab-plugin-1.1.13
gitlab-plugineqgitlab-plugin-1.1.16
gitlab-plugineqgitlab-plugin-1.0.10
gitlab-plugineqgitlab-plugin-1.1.3
gitlab-plugineqgitlab-plugin-1.5.3
gitlab-plugineqgitlab-plugin-1.5.7
gitlab-plugineqgitlab-plugin-1.2.3
gitlab-plugineqgitlab-plugin-1.1.21
gitlab-plugineqgitlab-plugin-1.4.1

Name	Operator	Version
gitlab-plugin	eq	gitlab-plugin-1.0.8
gitlab-plugin	eq	gitlab-plugin-1.1.13
gitlab-plugin	eq	gitlab-plugin-1.1.16
gitlab-plugin	eq	gitlab-plugin-1.0.10
gitlab-plugin	eq	gitlab-plugin-1.1.3
gitlab-plugin	eq	gitlab-plugin-1.5.3
gitlab-plugin	eq	gitlab-plugin-1.5.7
gitlab-plugin	eq	gitlab-plugin-1.2.3
gitlab-plugin	eq	gitlab-plugin-1.1.21
gitlab-plugin	eq	gitlab-plugin-1.4.1