GHSA-6f4q-f5fj-q6fcMediumCVSS 4.3

CSRF vulnerability in Bazaar Plugin

Published
July 26, 2023
Last Modified
November 11, 2023

🔗 CVE IDs covered (1)

CVE-2023-39156 →

📋 Description

Jenkins Bazaar Plugin 1.22 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to delete previously created Bazaar SCM tags.

🎯 Affected products1

  • maven/org.jenkins-ci.plugins:bazaar:<= 1.22

🔗 References (4)