GitHub Advisoryadvisory · Maven

GHSA-rrvg-2c69-p9rf CSRF vulnerability in Jenkins Xray - Test Management for Jira Plugin allows capturing credentials

HIGH Published 2021-06-16 Modified 2023-10-27 Official page ↗
Aliases
CVE-2021-21652
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:xray-connector
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Weaknesses
CWE-352
Reviewed
2021-05-19

Affected packages

• Maven org.jenkins-ci.plugins:xray-connector: < 2.4.1 → fixed in 2.4.1

Description

Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier does not require POST requests for a connection test method, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Jenkins Xray - Test Management for Jira Plugin 2.4.1 requires POST requests for the affected connection test method.

Related

Alias · CVE (1)

  • CVE-2021-21652 A cross-site request forgery (CSRF) vulnerability in Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier allows attackers to… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References