~ / search / GHSA-c264-8834-ppj2

GHSA-c264-8834-ppj2

CSRF vulnerability in Jenkins Swarm Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-2192

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:swarm < 3.21 3.21

Details

As written in the advisory (Markdown source, shown as plain text).

Swarm Plugin adds API endpoints to add or remove agent labels. In Swarm Plugin 3.20 and earlier these only require a global Swarm secret to use, and no regular permission check is performed. This allows users with Agent/Create permission to add or remove labels of any agent. Additionally, these API endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability. Swarm Plugin 3.21 requires POST requests and Agent/Configure permission for the affected agent to these endpoints. It no longer uses the global Swarm secret for these API endpoints.

References

External links from the advisory. They lead to third-party sites.