~ / search / GHSA-774g-r3fm-4v85

GHSA-774g-r3fm-4v85

CSRF vulnerability in Jenkins Role-based Authorization Strategy Plugin configuration

Source: GitHub Advisory Database (reviewed) High CVE-2017-1000090

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:role-strategy < 2.5.1 2.5.1

Details

As written in the advisory (Markdown source, shown as plain text).

Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to add administrator role to any user, or to remove the authorization configuration, preventing legitimate access to Jenkins.

References

External links from the advisory. They lead to third-party sites.