Lucene search

K
osvGoogleOSV:GHSA-48G9-H7G5-8PW2
HistoryApr 02, 2023 - 9:30 p.m.

Jenkins Convert To Pipeline Plugin vulnerable to cross-site request forgery

2023-04-0221:30:17
Google
osv.dev
4
jenkins
convert to pipeline plugin
cross-site request forgery
freestyle project
http endpoint
security-2966
cve-2023-28677
unsandboxed pipeline scripts

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

55.0%

Convert To Pipeline Plugin 1.0 and earlier does not require POST requests for the HTTP endpoint converting a Freestyle project to Pipeline, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to create a Pipeline based on a Freestyle project. Combined with SECURITY-2966/CVE-2023-28677, this can result in the execution of unsandboxed Pipeline scripts.

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

55.0%

Related for OSV:GHSA-48G9-H7G5-8PW2