What is GHSA-63jg-5wv6-7ghv?

GHSA-63jg-5wv6-7ghv is a security advisory published by GitHub Security Advisories with Low severity. Jenkins Resource Disposer Plugin allows attacker to stop tracking specified resource

Which CVE IDs does GHSA-63jg-5wv6-7ghv cover?

GHSA-63jg-5wv6-7ghv covers the following CVE IDs: CVE-2018-1999037. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-63jg-5wv6-7ghv?

GHSA-63jg-5wv6-7ghv has a CVSS v3 base score of 3.1, published by GitHub Security Advisories.

Which products are affected by GHSA-63jg-5wv6-7ghv?

GHSA-63jg-5wv6-7ghv affects 1 product, including: maven/org.jenkins-ci.plugins:resource-disposer:\u003c= 0.11.

GHSA-63jg-5wv6-7ghvLowCVSS 3.1

Jenkins Resource Disposer Plugin allows attacker to stop tracking specified resource

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

December 20, 2023

🔗 CVE IDs covered (1)

CVE-2018-1999037 →

📋 Description

A data modification vulnerability exists in Jenkins Resource Disposer Plugin 0.11 and earlier in AsyncResourceDisposer.java that allows attackers to stop tracking a specified resource. Additionally, this API endpoint did not require POST requests, resulting in a CSRF vulnerability. As of version 0.12, this API endpoint requires POST requests and Overall/Administer permissions.

🎯 Affected products1

maven/org.jenkins-ci.plugins:resource-disposer:<= 0.11

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2018-1999037
https://jenkins.io/security/advisory/2018-07-30/#SECURITY-997
https://github.com/jenkinsci/resource-disposer-plugin/commit/d826a99b06cc46c5dfadfd526b519ef0f65c8682
https://github.com/advisories/GHSA-63jg-5wv6-7ghv