GHSA-42mm-x828-56c7

CSRF vulnerability in Jenkins Configuration Slicing Plugin

Source: GitHub Advisory Database (reviewed) High CVE-2021-21617

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:configurationslicing	< 1.52	1.52

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Configuration Slicing Plugin 1.51 and earlier does not require POST requests for the form submission endpoint reconfiguring slices, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to apply different slice configurations to attacker-specified jobs. Jenkins Configuration Slicing Plugin 1.52 requires POST requests for the affected HTTP endpoint.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-21617 advisory
https://github.com/jenkinsci/configurationslicing-plugin/commit/b22b82df3654e8379466a51de4391884aa4d6156 web
https://github.com/jenkinsci/configurationslicing-plugin package
https://www.jenkins.io/security/advisory/2021-02-24/#SECURITY-2003 web
http://www.openwall.com/lists/oss-security/2021/02/24/3 web