Lucene search

GitHub Advisory DatabaseGHSA-5R5C-7RM4-MP4R

HistoryJul 12, 2023 - 6:30 p.m.

Jenkins Rebuilder Plugin vulnerable to Cross Site Request Forgery

2023-07-1218:30:38

CWE-352

GitHub Advisory Database

github.com

jenkins

rebuilder plugin

csrf

vulnerability

http

endpoint

attackers

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

0.0005 Low

EPSS

Percentile

17.6%

JSON

Jenkins Rebuilder Plugin 320.v5a_0933a_e7d61 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to rebuild a previous build.

Affected configurations

Vulners

Node

com.sonyericsson.hudson.plugins.rebuild\Matchrebuild

CPENameOperatorVersion
com.sonyericsson.hudson.plugins.rebuild:rebuildle320.v5a

CPE	Name	Operator	Version
	com.sonyericsson.hudson.plugins.rebuild:rebuild	le	320.v5a

References

www.openwall.com/lists/oss-security/2023/07/12/2

github.com/advisories/GHSA-5r5c-7rm4-mp4r

nvd.nist.gov/vuln/detail/CVE-2023-37954

www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3033

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

0.0005 Low

EPSS

Percentile

17.6%

JSON

Related for GHSA-5R5C-7RM4-MP4R