GitHub Advisoryadvisory · Maven

GHSA-fg4r-f9j2-36mw Jenkins Cross-Site Request Forgery vulnerabilities

MEDIUM Published 2022-05-17 Modified 2023-02-08 Official page ↗
Aliases
CVE-2013-2034
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
Weaknesses
CWE-352
Reviewed
2023-02-08

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: < 1.509.1 → fixed in 1.509.1 • Maven org.jenkins-ci.main:jenkins-core: >= 1.513, < 1.514 → fixed in 1.514

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary code or (2) initiate deployment of binaries to a Maven repository via unspecified vectors.

Related

Alias · CVE (1)

  • CVE-2013-2034 Multiple cross-site request forgery (CSRF) vulnerabilities in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References