Jenkins docker-build-step Plugin Cross-Site Request Forgery vulnerability

2024-03-0618:30:39

Google

osv.dev

jenkins

docker-build-step

csrf

vulnerability

tcp

unix socket

connection test parameters

build step executions

software

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

A cross-site request forgery (CSRF) vulnerability in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting future build step executions.

CPENameOperatorVersion
org.jenkins-ci.plugins:docker-build-stepeq2.6
org.jenkins-ci.plugins:docker-build-stepeq1.25
org.jenkins-ci.plugins:docker-build-stepeq2.9
org.jenkins-ci.plugins:docker-build-stepeq1.13
org.jenkins-ci.plugins:docker-build-stepeq1.22
org.jenkins-ci.plugins:docker-build-stepeq1.20
org.jenkins-ci.plugins:docker-build-stepeq1.41
org.jenkins-ci.plugins:docker-build-stepeq1.12
org.jenkins-ci.plugins:docker-build-stepeq1.38
org.jenkins-ci.plugins:docker-build-stepeq1.30

Name	Operator	Version
org.jenkins-ci.plugins:docker-build-step	eq	2.6
org.jenkins-ci.plugins:docker-build-step	eq	1.25
org.jenkins-ci.plugins:docker-build-step	eq	2.9
org.jenkins-ci.plugins:docker-build-step	eq	1.13
org.jenkins-ci.plugins:docker-build-step	eq	1.22
org.jenkins-ci.plugins:docker-build-step	eq	1.20
org.jenkins-ci.plugins:docker-build-step	eq	1.41
org.jenkins-ci.plugins:docker-build-step	eq	1.12
org.jenkins-ci.plugins:docker-build-step	eq	1.38
org.jenkins-ci.plugins:docker-build-step	eq	1.30