GHSA-58rq-69jp-xc23MediumCVSS 4.3

Jenkins Build Failure Analyzer Plugin Cross-Site Request Forgery vulnerability

Published
September 20, 2023
Last Modified
November 12, 2023

🔗 CVE IDs covered (1)

CVE-2023-43500 →

📋 Description

Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not perform a permission check in a connection test HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password.

Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Build Failure Analyzer Plugin 2.4.2 requires POST requests and Overall/Administer permission for the affected HTTP endpoint.

🎯 Affected products1

  • maven/com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer:< 2.4.2

🔗 References (4)