GHSA-rvww-w62m-hch8

CSRF vulnerability in Jenkins Lockable Resources Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-2281

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.6wind.jenkins:lockable-resources	< 2.9	2.9

Details

As written in the advisory (Markdown source, shown as plain text).

Lockable Resources Plugin 2.8 and earlier does not require POST requests for several HTTP endpoints, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to reserve, unreserve, unlock, and reset resources. Lockable Resources Plugin 2.9 requires POST requests for the affected HTTP endpoints.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-2281 advisory
https://github.com/jenkinsci/lockable-resources-plugin/commit/50ab82498f792775a761e6f4937607b240ecde67 web
https://github.com/jenkinsci/lockable-resources-plugin package
https://www.jenkins.io/security/advisory/2020-09-23/#SECURITY-1958 web
http://www.openwall.com/lists/oss-security/2020/09/23/1 web