CSRF vulnerability in Jenkins promoted builds Plugin

2022-05-2417:46:47

Google

osv.dev

4.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.7%

JSON

Jenkins promoted builds Plugin 3.9 and earlier does not require POST requests for HTTP endpoints implementing promotion (regular, forced, and re-execute), resulting in cross-site request forgery (CSRF) vulnerabilities.

These vulnerabilities allow attackers to promote builds.

Jenkins promoted builds Plugin 3.9.1 requires POST requests for the affected HTTP endpoints.

A security hardening since Jenkins 2.287 and LTS 2.277.2 prevents exploitation of this vulnerability.

CPENameOperatorVersion
org.jenkins-ci.plugins:promoted-buildseq2.18
org.jenkins-ci.plugins:promoted-buildseq2.20
org.jenkins-ci.plugins:promoted-buildseq2.10
org.jenkins-ci.plugins:promoted-buildseq2.1
org.jenkins-ci.plugins:promoted-buildseq2.29
org.jenkins-ci.plugins:promoted-buildseq2.31
org.jenkins-ci.plugins:promoted-buildseq2.31.1
org.jenkins-ci.plugins:promoted-buildseq2.3
org.jenkins-ci.plugins:promoted-buildseq3.5
org.jenkins-ci.plugins:promoted-buildseq2.25

Name	Operator	Version
org.jenkins-ci.plugins:promoted-builds	eq	2.18
org.jenkins-ci.plugins:promoted-builds	eq	2.20
org.jenkins-ci.plugins:promoted-builds	eq	2.10
org.jenkins-ci.plugins:promoted-builds	eq	2.1
org.jenkins-ci.plugins:promoted-builds	eq	2.29
org.jenkins-ci.plugins:promoted-builds	eq	2.31
org.jenkins-ci.plugins:promoted-builds	eq	2.31.1
org.jenkins-ci.plugins:promoted-builds	eq	2.3
org.jenkins-ci.plugins:promoted-builds	eq	3.5
org.jenkins-ci.plugins:promoted-builds	eq	2.25