GitHub Advisoryadvisory · Maven

GHSA-rvww-w62m-hch8 CSRF vulnerability in Jenkins Lockable Resources Plugin

MEDIUM Published 2022-05-24 Modified 2023-01-05 Official page ↗
Aliases
CVE-2020-2281
Ecosystem
Maven
Packages
org.6wind.jenkins:lockable-resources
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Weaknesses
CWE-352
Reviewed
2023-01-05

Affected packages

• Maven org.6wind.jenkins:lockable-resources: < 2.9 → fixed in 2.9

Description

Lockable Resources Plugin 2.8 and earlier does not require POST requests for several HTTP endpoints, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to reserve, unreserve, unlock, and reset resources. Lockable Resources Plugin 2.9 requires POST requests for the affected HTTP endpoints.

Related

Alias · CVE (1)

  • CVE-2020-2281 A cross-site request forgery (CSRF) vulnerability in Jenkins Lockable Resources Plugin 2.8 and earlier allows attackers to reserve,… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References