GHSA-62fp-j75q-mqhcHighCVSS 8.8

Jenkins CRX Content Package Deployer Plugin subject to Cross-Site Request Forgery

Published
May 24, 2022
Last Modified
October 26, 2023

🔗 CVE IDs covered (1)

CVE-2019-10437 →

📋 Description

A cross-site request forgery vulnerability in Jenkins CRX Content Package Deployer Plugin prior to 1.9 allowed attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. This issue is patched in version 1.9

🎯 Affected products1

  • maven/org.jenkins-ci.plugins:crx-content-package-deployer:< 1.9

🔗 References (4)