CVE-2024-23902 CSRF vulnerability in Jenkins GitLab Branch Source Plugin

What is CVE-2024-23902?

CVE-2024-23902 is a medium-severity vulnerability in Jenkins GitLab Branch Source Plugin, published on 24 Jan 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier allows attackers to connect to an attacker-specified URL.

Weakness: CWE-352

Which versions are affected by CVE-2024-23902?

2 open source packages ship an affected version, including io.jenkins.plugins:gitlab-branch-source. It affects 1 product.

Products include Jenkins Github Branch Source.

How do I fix CVE-2024-23902?

Upgrade io.jenkins.plugins:gitlab-branch-source to 688.v5fa or later.

Is CVE-2024-23902 being exploited?

There is no known exploitation of CVE-2024-23902 in the wild and no public exploit code.

Other vulnerabilities in Jenkins GitLab Branch Source Plugin

• CVE-2024-23901 Shared projects are unconditionally discovered by Jenkins GitLab Branch Source Plugin Medium 6.5
• CVE-2017-1000091 Jenkins GitHub Branch Source Plugin vulnerable to Cross-Site Request Forgery Medium 6.3
• CVE-2024-23903 Non-constant time webhook token comparison in Jenkins GitLab Branch Source Plugin Medium 5.3
• CVE-2026-57285 Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs Medium 4.3
• CVE-2026-42522 Jenkins GitHub Branch Source Plugin: Missing permissions check allows attackers to perform a connection test Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8r93-59cf-358f.