~ / search / GHSA-48g9-h7g5-8pw2

GHSA-48g9-h7g5-8pw2

Jenkins Convert To Pipeline Plugin vulnerable to cross-site request forgery

Source: GitHub Advisory Database (reviewed) High CVE-2023-28676

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:convert-to-pipeline <= 1.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Convert To Pipeline Plugin 1.0 and earlier does not require POST requests for the HTTP endpoint converting a Freestyle project to Pipeline, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to create a Pipeline based on a Freestyle project. Combined with [SECURITY-2966](https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2966)/CVE-2023-28677, this can result in the execution of unsandboxed Pipeline scripts.

References

External links from the advisory. They lead to third-party sites.