GitHub Advisoryadvisory · Maven

GHSA-xc7q-p3f4-q389 Jenkins Project Inheritance Plugin vulnerable to Cross-Site Request Forgery

MEDIUM Published 2022-05-24 Modified 2023-02-23 Official page ↗
Aliases
CVE-2019-10408
Ecosystem
Maven
Packages
hudson.plugins:project-inheritance
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-352
Reviewed
2023-02-23

Affected packages

• Maven hudson.plugins:project-inheritance: < 19.08.2 → fixed in 19.08.2

Description

Project Inheritance Plugin allows the creation of projects based on templates defined in the plugin configuration. A missing permission check in the HTTP endpoint triggering project creation allowed users with Overall/Read permission to create these projects. Additionally, the HTTP endpoint did not require POST requests, resulting in a CSRF vulnerability. The HTTP endpoint triggering project creation now requires Item/Create permission and submission of requests via POST.

Related

Alias · CVE (1)

  • CVE-2019-10408 A cross-site request forgery vulnerability in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers to trigger project… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References