GHSA-5cxw-8v65-76vf
CSRF vulnerability in Jenkins promoted builds Plugin
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins:promoted-builds | < 3.9.1 | 3.9.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
Jenkins promoted builds Plugin 3.9 and earlier does not require POST requests for HTTP endpoints implementing promotion (regular, forced, and re-execute), resulting in cross-site request forgery (CSRF) vulnerabilities.
These vulnerabilities allow attackers to promote builds.
Jenkins promoted builds Plugin 3.9.1 requires POST requests for the affected HTTP endpoints.
A security hardening since Jenkins 2.287 and LTS 2.277.2 prevents exploitation of this vulnerability.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2021-21641
- https://github.com/jenkinsci/promoted-builds-plugin/commit/46086a74891d620042c3d28a19cba3510c5dbf6a
- https://github.com/jenkinsci/promoted-builds-plugin
- https://www.jenkins.io/security/advisory/2021-04-07/#SECURITY-2293
- http://www.openwall.com/lists/oss-security/2021/04/07/2