GHSA-jf9j-hx2j-m9xh

CSRF vulnerability in Jenkins Database Plugin

Source: GitHub Advisory Database (reviewed) High CVE-2020-2240

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:database	< 1.7	1.7

Details

As written in the advisory (Markdown source, shown as plain text).

Database Plugin 1.6 and earlier does not require POST requests for the database console, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to execute arbitrary SQL scripts. Database Plugin 1.7 removes the database console.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-2240 advisory
https://github.com/jenkinsci/database-plugin/commit/a68258cf17ba8d5264010cc760770a62a3cc6c2d web
https://github.com/jenkinsci/database-plugin package
https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1023 web
http://www.openwall.com/lists/oss-security/2020/09/01/3 web