CSRF vulnerability in Jenkins Shelve Project Plugin

2022-05-2417:35:08

Google

osv.dev

0.001 Low

EPSS

Percentile

25.1%

JSON

Jenkins Shelve Project Plugin 3.0 and earlier does not require POST requests for HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities.

These vulnerabilities allow attackers to shelve, unshelve, or delete a project.

Jenkins Shelve Project Plugin 3.1 requires POST requests for the affected HTTP endpoints.

CPENameOperatorVersion
org.jenkins-ci.plugins:shelve-project-plugineq2.1
org.jenkins-ci.plugins:shelve-project-plugineq2.3
org.jenkins-ci.plugins:shelve-project-plugineq1.4.4
org.jenkins-ci.plugins:shelve-project-plugineq2.2
org.jenkins-ci.plugins:shelve-project-plugineq3.0
org.jenkins-ci.plugins:shelve-project-plugineq2.0
org.jenkins-ci.plugins:shelve-project-plugineq1.5
org.jenkins-ci.plugins:shelve-project-plugineq2.5
org.jenkins-ci.plugins:shelve-project-plugineq3.0-alpha-1
org.jenkins-ci.plugins:shelve-project-plugineq1.3

Name	Operator	Version
org.jenkins-ci.plugins:shelve-project-plugin	eq	2.1
org.jenkins-ci.plugins:shelve-project-plugin	eq	2.3
org.jenkins-ci.plugins:shelve-project-plugin	eq	1.4.4
org.jenkins-ci.plugins:shelve-project-plugin	eq	2.2
org.jenkins-ci.plugins:shelve-project-plugin	eq	3.0
org.jenkins-ci.plugins:shelve-project-plugin	eq	2.0
org.jenkins-ci.plugins:shelve-project-plugin	eq	1.5
org.jenkins-ci.plugins:shelve-project-plugin	eq	2.5
org.jenkins-ci.plugins:shelve-project-plugin	eq	3.0-alpha-1
org.jenkins-ci.plugins:shelve-project-plugin	eq	1.3