GHSA-4ffq-6g62-j4v4MediumCVSS 4.3

Cross-Site Request Forgery in the Jenkins Claim plugin

Published
June 16, 2021
Last Modified
October 27, 2023

🔗 CVE IDs covered (1)

CVE-2021-21620 →

📋 Description

Jenkins Claim Plugin 2.18.1 and earlier does not require POST requests for the form submission endpoint assigning claims, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to change claims.

Jenkins Claim Plugin 2.18.2 requires POST requests for the affected HTTP endpoint.

🎯 Affected products1

  • maven/org.jenkins-ci.plugins:claim:< 2.18.2

🔗 References (3)