{"id":"CVE-2023-39153","details":"A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick users into logging in to the attacker's account.","aliases":["GHSA-cg6r-gqvc-r396"],"modified":"2026-07-09T10:58:32.073684Z","published":"2023-07-26T14:15:10.597Z","references":[{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2023/07/26/2"},{"type":"ADVISORY","url":"https://www.jenkins.io/security/advisory/2023-07-26/#SECURITY-2696"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jenkinsci/gitlab-oauth-plugin","events":[{"introduced":"0"},{"last_affected":"b89028adb3cbb0f2dd9baa4e8d43991d4814f739"}],"database_specific":{"cpe":"cpe:2.3:a:jenkins:gitlab_authentication:*:*:*:*:*:jenkins:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"1.17.1"}],"source":"CPE_RANGE"}}],"versions":["gitlab-oauth-1.17.1","gitlab-oauth-1.17","gitlab-oauth-1.16","gitlab-oauth-1.15","gitlab-oauth-1.14","gitlab-oauth-1.13","gitlab-oauth-1.12","gitlab-oauth-1.11","gitlab-oauth-1.10","gitlab-oauth-1.9","gitlab-oauth-1.8","gitlab-oauth-1.7","gitlab-oauth-1.6","gitlab-oauth-1.5","gitlab-oauth-1.0.3","gitlab-oauth-1.0.2","gitlab-oauth-1.0.1","gitlab-oauth-1.0.0","github-oauth-0.22.3","github-oauth-0.22.2","github-oauth-0.22.1","github-oauth-0.22","github-oauth-0.21.2","github-oauth-0.21.1","github-oauth-0.21","github-oauth-0.20","github-oauth-0.19","github-oauth-0.18","github-oauth-0.17","github-oauth-0.16","github-oauth-0.15","github-oauth-0.14","github-oauth-0.13.1","github-oauth-0.13","github-oauth-0.12"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-39153.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"}]}