CSRF vulnerability in Jenkins CVS Plugin

2022-05-2417:17:14

Google

osv.dev

0.001 Low

EPSS

Percentile

26.7%

JSON

CVS Plugin 2.15 and earlier does not require POST requests in several HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities. This allows attackers to create and manipulate tags, and to connect to an attacker-specified URL.

CVS Plugin 2.16 now requires POST requests for the affected HTTP endpoints.

CPENameOperatorVersion
org.jenkins-ci.plugins:cvseq2.12
org.jenkins-ci.plugins:cvseq2.9
org.jenkins-ci.plugins:cvseq1.6
org.jenkins-ci.plugins:cvseq1.5
org.jenkins-ci.plugins:cvseq2.15
org.jenkins-ci.plugins:cvseq2.7
org.jenkins-ci.plugins:cvseq2.6
org.jenkins-ci.plugins:cvseq2.11
org.jenkins-ci.plugins:cvseq2.4
org.jenkins-ci.plugins:cvseq2.8

Name	Operator	Version
org.jenkins-ci.plugins:cvs	eq	2.12
org.jenkins-ci.plugins:cvs	eq	2.9
org.jenkins-ci.plugins:cvs	eq	1.6
org.jenkins-ci.plugins:cvs	eq	1.5
org.jenkins-ci.plugins:cvs	eq	2.15
org.jenkins-ci.plugins:cvs	eq	2.7
org.jenkins-ci.plugins:cvs	eq	2.6
org.jenkins-ci.plugins:cvs	eq	2.11
org.jenkins-ci.plugins:cvs	eq	2.4
org.jenkins-ci.plugins:cvs	eq	2.8