GHSA-fc92-8r77-9297MediumCVSS 5.0

CSRF vulnerability in Health Advisor by CloudBees Plugin

Published
May 24, 2022
Last Modified
December 21, 2023

🔗 CVE IDs covered (1)

CVE-2020-2093 →

📋 Description

Health Advisor by CloudBees Plugin 3.0 and earlier does not perform permission checks in methods performing form validation. This allows users with Overall/Read access to send an email with fixed content to an attacker-specified recipient.

Additionally, these form validation methods do not require POST requests, resulting in a CSRF vulnerability.

Health Advisor by CloudBees Plugin 3.0.1 requires POST requests and Overall/Administer permission for the affected form validation methods.

🎯 Affected products1

  • maven/org.jenkins-ci.plugins:cloudbees-jenkins-advisor:< 3.0.1

🔗 References (4)