CVE-2024-23903

CVE-2024-23903 affects Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier, which uses a non-constant time comparison for validating webhook tokens. This non-constant-time check can enable attackers to infer a valid webhook token via statistical analysis. The connected GitHub advi...

CVE-2024-23902

CVE-2024-23902 concerns the Jenkins GitLab Branch Source Plugin, affecting versions 684.vea_fa_7c1e2fe3 and earlier. The root cause is a CSRF vulnerability: the plugin’s form validation endpoint does not require POST requests, enabling an attacker to have the user connect to an attacker-specified...

CVE-2024-23901

The CVE concerns Jenkins GitLab Branch Source Plugin versions 684.vea_fa_7c1e2fe3 and earlier. The vulnerability is that the plugin unconditionally discovers projects shared with the configured owner group, enabling attackers to configure and share a project, which can cause Jenkins to build a cr...