~ / search / GHSA-6f4q-f5fj-q6fc

GHSA-6f4q-f5fj-q6fc

CSRF vulnerability in Bazaar Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-39156

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:bazaar <= 1.22 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Bazaar Plugin 1.22 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to delete previously created Bazaar SCM tags.

References

External links from the advisory. They lead to third-party sites.