GHSA-3fj7-78h2-w98xMediumCVSS 4.3

Jenkins XPath Configuration Viewer Plugin Missing Authorization vulnerability

Published
July 1, 2022
Last Modified
October 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-34813 →

📋 Description

Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to create and delete XPath expressions.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix.

🎯 Affected products1

  • maven/org.jenkins-ci.plugins:xpath-config-viewer:<= 1.1.1

🔗 References (3)