GHSA-w6hw-57jq-h7f5LowCVSS 3.1

CSRF vulnerability in Amazon EC2 Plugin

Published
May 24, 2022
Last Modified
December 20, 2023

🔗 CVE IDs covered (1)

CVE-2020-2186 →

📋 Description

Amazon EC2 Plugin 1.50.1 and earlier does not require POST requests in several HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities. This allows an attacker to provision instances with an attacker-specified template ID.

Amazon EC2 Plugin 1.50.2 now requires POST requests for the affected HTTP endpoints.

🎯 Affected products1

  • maven/org.jenkins-ci.plugins:ec2:<= 1.50.1

🔗 References (5)