GitHub Advisoryadvisory · Maven

GHSA-63mw-hp3h-gc77 CSRF vulnerability in Jenkins CVS Plugin

MEDIUM Published 2022-05-24 Modified 2022-12-16 Official page ↗
Aliases
CVE-2020-2184
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:cvs
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-352
Reviewed
2022-12-16

Affected packages

• Maven org.jenkins-ci.plugins:cvs: < 2.16 → fixed in 2.16

Description

CVS Plugin 2.15 and earlier does not require POST requests in several HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities. This allows attackers to create and manipulate tags, and to connect to an attacker-specified URL. CVS Plugin 2.16 now requires POST requests for the affected HTTP endpoints.

Related

Alias · CVE (1)

  • CVE-2020-2184 A cross-site request forgery vulnerability in Jenkins CVS Plugin 2.15 and earlier allows attackers to create and manipulate tags, and to… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References