GHSA-42mm-x828-56c7

Source

https://github.com/advisories/GHSA-42mm-x828-56c7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-42mm-x828-56c7/GHSA-42mm-x828-56c7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-42mm-x828-56c7

Aliases

CVE-2021-21617

Published

2022-05-24T17:43:00Z

Modified

2024-02-16T08:15:59.796346Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

CSRF vulnerability in Jenkins Configuration Slicing Plugin

Details

Jenkins Configuration Slicing Plugin 1.51 and earlier does not require POST requests for the form submission endpoint reconfiguring slices, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to apply different slice configurations to attacker-specified jobs.

Jenkins Configuration Slicing Plugin 1.52 requires POST requests for the affected HTTP endpoint.

Database specific

{
    "nvd_published_at": "2021-02-24T16:15:00Z",
    "cwe_ids": [
        "CWE-352"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-13T18:55:05Z"
}

References

Affected packages

Maven / org.jenkins-ci.plugins:configurationslicing

Package

Name: org.jenkins-ci.plugins:configurationslicing; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/configurationslicing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.52

Affected versions

1.*

1.39

1.40

1.41

1.44

1.45

1.47

1.50

1.51

Database specific

{
    "last_known_affected_version_range": "<= 1.51"
}