GHSA-63mw-hp3h-gc77MediumCVSS 4.3

CSRF vulnerability in Jenkins CVS Plugin

Published
May 24, 2022
Last Modified
December 19, 2023

🔗 CVE IDs covered (1)

CVE-2020-2184 →

📋 Description

CVS Plugin 2.15 and earlier does not require POST requests in several HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities. This allows attackers to create and manipulate tags, and to connect to an attacker-specified URL.

CVS Plugin 2.16 now requires POST requests for the affected HTTP endpoints.

🎯 Affected products1

  • maven/org.jenkins-ci.plugins:cvs:<= 2.15

🔗 References (5)