CVE-2024-23901: Shared projects are unconditionally discovered by Jenkins GitLab Branch Source Plugin

January 24, 2024

Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier unconditionally discovers projects that are shared with the configured owner group, allowing attackers to configure and share a project, resulting in a crafted Pipeline being built by Jenkins during the next scan of the group.

References

www.openwall.com/lists/oss-security/2024/01/24/6
github.com/advisories/GHSA-fw9h-cxx9-gfq3
github.com/jenkinsci/gitlab-branch-source-plugin/commit/969ccece8e2185ecdb7c342b27173af1ab17045c
nvd.nist.gov/vuln/detail/CVE-2024-23901
www.jenkins.io/security/advisory/2024-01-24/

Code Behaviors & Features

Detect and mitigate CVE-2024-23901 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →