Cross-site Request Forgery (CSRF)

2023-05-2109:59:34

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site request forgery

csrf

jenkins

http endpoint

vulnerability

0.0005 Low

EPSS

Percentile

16.2%

JSON

org.jenkins-ci.plugins:email-ext is vulnerable to Cross-Site Request Forgery (CSRF). An attacker is able to make another user stop watching an attacker-specified job because the library does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery.

CPENameOperatorVersion
email extension pluginle2.96
email extension pluginle2.96
jenkins-2-pluginseq4.9.1667460322__1.el8
jenkins-2-pluginseq4.9.1674644684__1.el8
jenkins-2-pluginseq4.9.1642607680__1.el8
jenkins-2-pluginseq4.8.1642609156__1.el8
jenkins-2-pluginseq4.10.1671706212__1.el8
jenkins-2-pluginseq4.10.1667388055__1.el8
jenkins-2-pluginseq4.9.1644822177__1.el8
jenkins-2-pluginseq4.10.1647505461__1.el8

Name	Operator	Version
email extension plugin	le	2.96
email extension plugin	le	2.96
jenkins-2-plugins	eq	4.9.1667460322__1.el8
jenkins-2-plugins	eq	4.9.1674644684__1.el8
jenkins-2-plugins	eq	4.9.1642607680__1.el8
jenkins-2-plugins	eq	4.8.1642609156__1.el8
jenkins-2-plugins	eq	4.10.1671706212__1.el8
jenkins-2-plugins	eq	4.10.1667388055__1.el8
jenkins-2-plugins	eq	4.9.1644822177__1.el8
jenkins-2-plugins	eq	4.10.1647505461__1.el8