~ / search / GHSA-j896-j72w-cr32

GHSA-j896-j72w-cr32

Jenkins Job Configuration History Plugin does not require POST requests for several HTTP endpoints

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-36887

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:jobConfigHistory < 1156.v536a_97b_8d649 1156.v536a_97b_8d649

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Job Configuration History Plugin 1155.v28a_46a_cc06a_5 and earlier does not require POST requests for several HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow attackers to delete entries from job, agent, and system configuration history, or restore older versions of job, agent, and system configurations. Job Configuration History Plugin 1156.v536a_97b_8d649 requires POST requests for the affected HTTP endpoints.

References

External links from the advisory. They lead to third-party sites.