Lucene search
GoogleOSV:GHSA-V6H8-5CP2-J9W4HistoryJun 24, 2022 - 12:00 a.m.
Jenkins Jianliao Notification Plugin Missing Authorization vulnerability
2022-06-2400:00:31
Google
osv.dev
10
Jenkins Jianliao Notification Plugin 1.1 and earlier does not perform a permission check in a method implementing form validation.
This allows attackers with Overall/Read permission to send HTTP POST requests to an attacker-specified URL.
Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
As of publication of this advisory, there is no fix.
| CPE | Name | Operator | Version |
|---|---|---|---|
| org.jenkins-ci.plugins:jianliao | eq | 1.0 | |
| org.jenkins-ci.plugins:jianliao | eq | 1.1 |
Related
prion
prion
Design/Logic Flaw
2022-06-23 17:15:00
nvd
nvd
CVE-2022-34206
2022-06-23 17:15:17
cnvd
cnvd
Jenkins Jianliao Notification Plugin License Issue Vulnerability
2022-06-24 00:00:00
cvelist
cvelist
CVE-2022-34206
2022-06-22 14:41:47
cve
cve
CVE-2022-34206
2022-06-23 17:15:17
github
github
Jenkins Jianliao Notification Plugin Missing Authorization vulnerability
2022-06-24 00:00:31
nessus
nessus
Jenkins plugins Multiple Vulnerabilities (2022-06-22)
2022-07-15 00:00:00
Jenkins LTS < 2.332.4 / Jenkins weekly < 2.356 Multiple Vulnerabilities
2022-07-15 00:00:00