Vulnerability DatabaseCVE-2024-23902

CVE-2024-23902:
Java vulnerability analysis and mitigation

Overview

A cross-site request forgery (CSRF) vulnerability was discovered in Jenkins GitLab Branch Source Plugin versions 684.vea_fa_7c1e2fe3 and earlier. The vulnerability was assigned CVE-2024-23902 and was publicly disclosed on January 24, 2024. The affected component is the GitLab Branch Source Plugin, which is used for integration between Jenkins and GitLab (Jenkins Advisory).

Technical details

The vulnerability stems from the plugin's failure to require POST requests for a form validation endpoint. This implementation flaw results in a cross-site request forgery (CSRF) vulnerability. The severity of this vulnerability is rated as Medium according to the CVSS scoring system (Jenkins Advisory).

Impact

When exploited, this vulnerability allows attackers to connect to an attacker-specified URL through the affected form validation endpoint (Jenkins Advisory).

Mitigation and workarounds

The vulnerability has been fixed in GitLab Branch Source Plugin version 688.v5fa_356ee8520, which now requires POST requests for the affected form validation endpoint. Users are advised to upgrade to this version to mitigate the vulnerability (Jenkins Advisory).

Additional resources

Source: This report was generated using AI

View vulnerable instances

Not a customer? See how Wiz maps CVEs like this one to real cloud attack paths.

Watch 12-min demo

4.3

Score

Published January 24, 2024

Severity MEDIUM

CNA Score 4.3

Affected Technologies

Java
Jenkins

Has Public Exploit No

Has CISA KEV Exploit No

CISA KEV Release Date N/A

CISA KEV Due Date N/A

Exploitation Probability Percentile (EPSS) 15.1

Exploitation Probability (EPSS) N/A

Affected packages and libraries

jenkins
io.jenkins.plugins:gitlab-branch-source

Sources

NVD
Alpine Security Tracker
- Alpine 3.10, 3.11, 3.12, 3.19, 3.20, 3.21 Severity MEDIUMNo FixAdded at: Nov 18, 2025
- Alpine 3.13, 3.14, 3.15, 3.16, 3.17, 3.18, edge Severity MEDIUMNo FixAdded at: Feb 04, 2024
GitHub Advisory Database
- Maven Severity MEDIUMHas FixAdded at: Jan 25, 2024

Get a CVE risk assessment

Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not just what's listed.

Request assessment

Related Java vulnerabilities:

CVE ID	Severity	Score	Technologies	Component name	CISA KEV exploit	Has fix	Published date
CVE-2025-29847	HIGH	7.5	Java	org.apache.linkis:linkis	No	Yes	Jan 19, 2026
CVE-2026-1050	MEDIUM	6.9	Java	net.risesoft:risenet-y9boot-support-platform-service	No	No	Jan 17, 2026
CVE-2025-15104	MEDIUM	6.9	JavaScript	vnu-jar	No	No	Jan 16, 2026
CVE-2025-59355	MEDIUM	6.5	Java	org.apache.linkis:linkis-metadata	No	Yes	Jan 19, 2026
CVE-2026-0858	MEDIUM	5.1	Java	net.sourceforge.plantuml:plantuml	No	Yes	Jan 16, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

A threat intelligence database

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."

David EstlickCISO

"Wiz provides a single pane of glass to see what is going on in our cloud environments."

Adam FletcherChief Security Officer

"We know that if Wiz identifies something as critical, it actually is."

Greg PoniatowskiHead of Threat and Vulnerability Management

Get a demo

CVE-2024-23902: Java vulnerability analysis and mitigation