GHSA-x9gm-m8pp-54vx

Jenkins JUnit Plugin CSRF vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-1000411

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:junit	< 1.26	1.26

Details

As written in the advisory (Markdown source, shown as plain text).

A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test result.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1000411 advisory
https://github.com/jenkinsci/junit-plugin/commit/091ee0dc8dd6023713827ce1a5914fa9fa9b6043 web
https://github.com/jenkinsci/junit-plugin web
https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1101 web
https://web.archive.org/web/20200227092927/http://www.securityfocus.com/bid/106532 web