What is GHSA-rvww-w62m-hch8?

GHSA-rvww-w62m-hch8 is a security advisory published by GitHub Security Advisories with Medium severity. CSRF vulnerability in Jenkins Lockable Resources Plugin

Which CVE IDs does GHSA-rvww-w62m-hch8 cover?

GHSA-rvww-w62m-hch8 covers the following CVE IDs: CVE-2020-2281. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rvww-w62m-hch8?

GHSA-rvww-w62m-hch8 has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-rvww-w62m-hch8?

GHSA-rvww-w62m-hch8 affects 1 product, including: maven/org.6wind.jenkins:lockable-resources:\u003c 2.9.

GHSA-rvww-w62m-hch8MediumCVSS 5.4

CSRF vulnerability in Jenkins Lockable Resources Plugin

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

December 14, 2023

🔗 CVE IDs covered (1)

CVE-2020-2281 →

📋 Description

Lockable Resources Plugin 2.8 and earlier does not require POST requests for several HTTP endpoints, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to reserve, unreserve, unlock, and reset resources. Lockable Resources Plugin 2.9 requires POST requests for the affected HTTP endpoints.

🎯 Affected products1

maven/org.6wind.jenkins:lockable-resources:< 2.9

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2020-2281
https://www.jenkins.io/security/advisory/2020-09-23/#SECURITY-1958
http://www.openwall.com/lists/oss-security/2020/09/23/1
https://github.com/jenkinsci/lockable-resources-plugin/commit/50ab82498f792775a761e6f4937607b240ecde67
https://github.com/advisories/GHSA-rvww-w62m-hch8