Lucene search

Veracode Vulnerability DatabaseVERACODE:41030

HistoryJun 27, 2023 - 8:06 a.m.

Cross-Site Request Forgery (CSRF)

2023-06-2708:06:56

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

jenkins

digital.ai

app management

csrf

http

authentication

attacker

unauthorized actions

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

37.0%

JSON

Jenkins Digital.ai App Management Publisher Plugin is vulnerable to Cross-Site Request Forgery (CSRF). The vulnerability exists because some HTTP endpoints do not require authentication, which allows an attacker to perform unauthorized actions.

CPENameOperatorVersion
digital.ai app management publisherle2.6
digital.ai app management publisherle2.6

CPE	Name	Operator	Version
	digital.ai app management publisher	le	2.6
	digital.ai app management publisher	le	2.6

References

github.com/advisories/GHSA-r72x-2h45-p59x

www.jenkins.io/security/advisory/2023-06-14/#SECURITY-2911

www.openwall.com/lists/oss-security/2023/06/14/5

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

37.0%

JSON

Related for VERACODE:41030