Jenkins GitLab Plugin Incorrect Permission Check Vulnerability Allowing Credential ID Enumeration

A vulnerability exists in Jenkins GitLab Plugin versions through 1.9.6, where an incorrect permission check allows attackers with global Item/Configure permission to enumerate credential IDs of GitLab API token and Secret text credentials stored in Jenkins. This issue arises because the plugin fails to properly validate permissions in an HTTP endpoint, enabling the enumeration of credential IDs that could be exploited to capture the credentials using another vulnerability.

Impact

Exploitation of this vulnerability allows for the enumeration of credential IDs, which could be used to capture sensitive credentials through other vulnerabilities.

Remediation

Users of Jenkins GitLab Plugin should update to version 1.9.7, which addresses this vulnerability.