GitHub Advisoryadvisory · Maven

GHSA-48g9-h7g5-8pw2 Jenkins Convert To Pipeline Plugin vulnerable to cross-site request forgery

HIGH Published 2023-04-02 Modified 2025-02-25 Official page ↗
Aliases
CVE-2023-28676
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:convert-to-pipeline
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352, CWE-652
Reviewed
2023-04-04

Affected packages

• Maven org.jenkins-ci.plugins:convert-to-pipeline: <= 1.0 (no fix yet)

Description

Convert To Pipeline Plugin 1.0 and earlier does not require POST requests for the HTTP endpoint converting a Freestyle project to Pipeline, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to create a Pipeline based on a Freestyle project. Combined with SECURITY-2966/CVE-2023-28677, this can result in the execution of unsandboxed Pipeline scripts.

Related

Alias · CVE (1)

  • CVE-2023-28676 A cross-site request forgery (CSRF) vulnerability in Jenkins Convert To Pipeline Plugin 1.0 and earlier allows attackers to create a… vulnerability

Weakness · CWE (2)

  • CWE-352 Cross-Site Request Forgery weakness
  • CWE-652 Improper Neutralization of Data within XQuery Expressions weakness

References