~ / search / GHSA-jrj6-qx48-3cpq

GHSA-jrj6-qx48-3cpq

Jenkins Favorite View Plugin cross-site request forgery vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-40351

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:favorite-view <= 5.v77a no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Favorite View Plugin 5.v77a_37f62782d and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to add or remove views from another user’s favorite views tab bar. As of publication of this advisory, there is no fix.

References

External links from the advisory. They lead to third-party sites.