GitHub Advisoryadvisory · Maven

GHSA-3vhr-f5xr-8vpx Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack

HIGH Published 2022-05-13 Modified 2025-03-13 Official page ↗
Aliases
CVE-2015-7537
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2025-03-13

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: >= 1.626, < 1.640 → fixed in 1.640 • Maven org.jenkins-ci.main:jenkins-core: < 1.625.2 → fixed in 1.625.2

Description

Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method.

Related

Alias · CVE (1)

  • CVE-2015-7537 Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References