~ / search / GHSA-w6hw-57jq-h7f5

GHSA-w6hw-57jq-h7f5

CSRF vulnerability in Amazon EC2 Plugin

Source: GitHub Advisory Database (reviewed) Low CVE-2020-2186

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:ec2 < 1.50.2 1.50.2

Details

As written in the advisory (Markdown source, shown as plain text).

Amazon EC2 Plugin 1.50.1 and earlier does not require POST requests in several HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities. This allows an attacker to provision instances with an attacker-specified template ID. Amazon EC2 Plugin 1.50.2 now requires POST requests for the affected HTTP endpoints.

References

External links from the advisory. They lead to third-party sites.