CVE-2024-23902
CSRF vulnerability in Jenkins GitLab Branch Source Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier allows attackers to connect to an attacker-specified URL.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier allows attackers to connect to an attacker-specified URL.
- Record
CVE-2024-23902- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List
A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier allows attackers to connect to an attacker-specified URL.
- Record
CVE-2024-23902- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
EUVDEUVD-2024-0303
A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier allows attackers to connect to an attacker-specified URL.
- Record
EUVD-2024-0303- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8r93-59cf-358f
CSRF vulnerability in Jenkins GitLab Branch Source Plugin
Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier does not require POST requests for a form validation endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.
This vulnerability allows attackers to connect to an attacker-specified URL.
GitLab Branch Source Plugin 688.v5fa_356ee8520 requires POST requests for the affected form validation endpoint.
- Record
GHSA-8r93-59cf-358f- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVGHSA-8r93-59cf-358f
CSRF vulnerability in Jenkins GitLab Branch Source Plugin
Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier does not require POST requests for a form validation endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.
This vulnerability allows attackers to connect to an attacker-specified URL.
GitLab Branch Source Plugin 688.v5fa_356ee8520 requires POST requests for the affected form validation endpoint.
- Record
GHSA-8r93-59cf-358f- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.jenkins.plugins:gitlab-branch-sourceMaven |
before 688.v5fa | 688.v5fa |
io.jenkins.plugins:gitlab-branch-sourceMaven |
before 688.v5fa, plus listed versions 0.0.5-alpha-20.0.7-beta0.0.8-beta1.0.01.1.0 Show 45 moreShow less1.1.1-alpha1.1.2-alpha1.2.01.2.11.2.21.3.01.4.01.4.11.4.21.4.31.4.41.4.51.4.61.5.01.5.11.5.21.5.31.5.41.5.51.5.61.5.71.5.81.5.9621.vd49608f876da_623.vcc98dc4b_0ce4625.v85cf3a_400cfe628.ve99e3d4df4b_8629.vb_cc76608e806630.v04ca_c57fa_880633.ved9984f943da_636.v55fd8144d335640.v7101b_1c0def9642.v9ed86b_b_54384643.vdc12a_4a_06434644.va_a_66886e07b_5645.v62a_b_6fce8659646.vb_9560d64b_69f647.vdee7766b_cfa_e649.v0dda_db_88b_5ee650.va_d1ce6d01959659.va_685a_51fda_db_660.vd45c0f4c0042663.v2602c3e6376d664.v877fdc293c89670.vf7df45517001 |
688.v5fa |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-23902 is a medium vulnerability (CVSS 4.3) in Jenkins Project Gitlab Branch Source Plugin, published January 24, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in io.jenkins.plugins:gitlab-branch-source 688.v5fa.
References
jenkins.io/security/advisory/2024-01-24
openwall.com/lists/oss-security/2024/01/24/6
nvd.nist.gov/vuln/detail/CVE-2024-23902
github.com/jenkinsci/gitlab-branch-source-plugin/commit/5fa356ee852091af900498db07259afe78d7aad2
Left out here: 6 versions. The JSON record has them.