GHSA-wfpw-hqjg-58ph

CSRF vulnerability in Jenkins Maven Cascade Release Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-2295

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.barchart.jenkins:maven-release-cascade	<= 1.3.2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A cross-site request forgery (CSRF) vulnerability in Jenkins Maven Cascade Release Plugin 1.3.2 and earlier allows attackers to start cascade builds and layout builds, and reconfigure the plugin.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-2295 advisory
https://github.com/jenkinsci/maven-release-cascade-plugin package
https://www.jenkins.io/security/advisory/2020-10-08/#SECURITY-2049 web
http://www.openwall.com/lists/oss-security/2020/10/08/5 web