GHSA-vx6r-w45x-q3h6HighCVSS 8.8

Jenkins Kubernetes CI/CD Plugin vulnerable to Cross-Site Request Forgery

Published
May 24, 2022
Last Modified
October 26, 2023

🔗 CVE IDs covered (1)

CVE-2019-10468 →

📋 Description

A cross-site request forgery vulnerability in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Note: Jenkins has suspended distribution of this plugin.

🎯 Affected products1

  • maven/com.elasticbox.jenkins-ci.plugins:kubernetes-ci:<= 1.3

🔗 References (5)