GitHub Advisoryadvisory · Maven

GHSA-9f37-ggxm-h6wx CSRF vulnerability in Jenkins Shelve Project Plugin

HIGH Published 2022-05-24 Modified 2023-10-27 Official page ↗
Aliases
CVE-2020-2321
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:shelve-project-plugin
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Weaknesses
CWE-352
Reviewed
2022-12-16

Affected packages

• Maven org.jenkins-ci.plugins:shelve-project-plugin: < 3.1 → fixed in 3.1

Description

Jenkins Shelve Project Plugin 3.0 and earlier does not require POST requests for HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow attackers to shelve, unshelve, or delete a project. Jenkins Shelve Project Plugin 3.1 requires POST requests for the affected HTTP endpoints.

Related

Alias · CVE (1)

  • CVE-2020-2321 A cross-site request forgery (CSRF) vulnerability in Jenkins Shelve Project Plugin 3.0 and earlier allows attackers to shelve, unshelve, or… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References