GHSA-x8j7-vxh9-p67gMediumCVSS 4.2

CSRF vulnerability in Jenkins Katalon Plugin allows capturing credentials

Published
October 19, 2022
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2022-43418 →

📋 Description

Katalon Plugin 1.0.33 and earlier does not require POST requests for several HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities.

This vulnerability allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Katalon Plugin 1.0.34 requires POST requests for the affected HTTP endpoints.

🎯 Affected products1

  • maven/org.jenkins-ci.plugins:katalon:< 1.0.34

🔗 References (4)