GHSA-2wf5-4mf7-vmh3

Suggest an improvement
Source
https://github.com/advisories/GHSA-2wf5-4mf7-vmh3
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-2wf5-4mf7-vmh3/GHSA-2wf5-4mf7-vmh3.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-2wf5-4mf7-vmh3
Aliases
Published
2022-05-24T17:33:07Z
Modified
2024-02-16T08:22:15.360144Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
Summary
CSRF vulnerability in Jenkins Active Directory Plugin
Details

Jenkins Active Directory Plugin 2.19 and earlier does not require POST requests for multiple HTTP endpoints implementing connection and authentication tests, resulting in cross-site request forgery (CSRF) vulnerabilities.

This vulnerability allows attackers to perform connection tests, connecting to attacker-specified or previously configured Active Directory servers using attacker-specified credentials.

Active Directory Plugin 2.20 requires POST requests for the affected HTTP endpoints.

Database specific 
{
    "nvd_published_at": "2020-11-04T15:15:00Z",
    "cwe_ids": [
        "CWE-352"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-21T19:36:47Z"
}
References

Affected packages

Maven / org.jenkins-ci.plugins:active-directory

Package

Name
org.jenkins-ci.plugins:active-directory
View open source insights on deps.dev
Purl
pkg:maven/org.jenkins-ci.plugins/active-directory

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.20

Affected versions

1.*

1.18
1.19
1.20
1.21
1.22
1.23
1.24
1.25
1.26
1.27
1.28
1.29
1.30
1.31
1.32
1.33
1.34
1.35
1.36
1.37
1.38
1.39
1.41
1.42
1.43
1.44
1.45
1.46
1.47
1.48
1.49

2.*

2.0
2.1
2.2
2.3
2.4
2.5
2.6
2.7
2.8
2.9
2.10
2.11
2.12
2.13
2.14
2.15
2.16
2.16.1
2.17
2.18
2.19