~ / search / GHSA-hmw6-r547-42fr

GHSA-hmw6-r547-42fr

Jenkins Pipeline restFul API Plugin vulnerable to Cross Site Request Forgery

Source: GitHub Advisory Database (reviewed) High CVE-2023-37957

Packages

EcosystemPackageAffectedFixed in
Maven io.jenkins.plugins:pipeline-restful-api <= 0.11 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Pipeline restFul API Plugin 0.11 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to have Jenkins connect to an attacker-specified URL, capturing a newly generated JCLI token that allows impersonating the victim.

References

External links from the advisory. They lead to third-party sites.