GitHub Advisoryadvisory · Maven

GHSA-gh5w-gffh-68pr Jenkins Lucene-Search Plugin vulnerable to Cross-Site Request Forgery

MEDIUM Published 2023-04-12 Modified 2023-04-12 Official page ↗
Aliases
CVE-2023-30529
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:lucene-search
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-352
Reviewed
2023-04-12

Affected packages

• Maven org.jenkins-ci.plugins:lucene-search: < 398.v3dfa_cb_223984 → fixed in 398.v3dfa_cb_223984

Description

Jenkins Lucene-Search Plugin 387.v938a_ecb_f7fe9 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to reindex the database.

Related

Alias · CVE (1)

  • CVE-2023-30529 Jenkins Lucene-Search Plugin 387.v938a_ecb_f7fe9 and earlier does not require POST requests for an HTTP endpoint, allowing attackers to… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References