CVE-2023-37961: CSRF
A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Auth Plugin 1.14 and earlier allows attackers to trick users into logging in to the attacker's account.
Other sources
Jenkins Assembla Auth Plugin 1.14 and earlier does not implement a state parameter in its OAuth flow, a unique and non-guessable value associated with each authentication request.
This vulnerability allows attackers to trick users into logging in to the attacker’s account.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-37961?
CVE-2023-37961 is a cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Auth Plugin 1.14 and earlier.
How does CVE-2023-37961 affect Jenkins Assembla Auth Plugin?
CVE-2023-37961 allows attackers to trick users into logging in to the attacker's account.
What is the severity of CVE-2023-37961?
CVE-2023-37961 has a severity rating of 8.8 (High).
How can I fix CVE-2023-37961?
To fix CVE-2023-37961, it is recommended to upgrade Jenkins Assembla Auth Plugin to version 1.15 or later.
Where can I find more information about CVE-2023-37961?
You can find more information about CVE-2023-37961 at the following references: [Jenkins Security Advisory](https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-2988), [Openwall OSS Security Mailing List](http://www.openwall.com/lists/oss-security/2023/07/12/2), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-37961).