Lucene search

Veracode Vulnerability DatabaseVERACODE:41313

HistoryJul 17, 2023 - 9:39 a.m.

Cross Site Request Forgery (CSRF)

2023-07-1709:39:31

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross site request forgery

csrf

sony ericsson

hudson

rebuilder

vulnerable

http endpoint

attacker

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

0.0005 Low

EPSS

Percentile

17.6%

JSON

com.sonyericsson.hudson.plugins.rebuild: rebuilder is vulnerable to Cross Site Request Forgery (CSRF). The vulnerability exists because it does not require POST requests for an HTTP endpoint which allows an attacker to rebuild a previous build.

CPENameOperatorVersion
rebuilderle320.v5a_0933a_e7d61
rebuilderle320.v5a_0933a_e7d61

CPE	Name	Operator	Version
	rebuilder	le	320.v5a_0933a_e7d61
	rebuilder	le	320.v5a_0933a_e7d61

References

www.openwall.com/lists/oss-security/2023/07/12/2

github.com/advisories/GHSA-5r5c-7rm4-mp4r

www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3033

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

0.0005 Low

EPSS

Percentile

17.6%

JSON

Related for VERACODE:41313