GHSA-5cxw-8v65-76vf

Suggest an improvement
Source
https://github.com/advisories/GHSA-5cxw-8v65-76vf
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-5cxw-8v65-76vf/GHSA-5cxw-8v65-76vf.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-5cxw-8v65-76vf
Aliases
Published
2022-05-24T17:46:47Z
Modified
2024-02-16T08:22:08.815963Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
Summary
CSRF vulnerability in Jenkins promoted builds Plugin
Details

Jenkins promoted builds Plugin 3.9 and earlier does not require POST requests for HTTP endpoints implementing promotion (regular, forced, and re-execute), resulting in cross-site request forgery (CSRF) vulnerabilities.

These vulnerabilities allow attackers to promote builds.

Jenkins promoted builds Plugin 3.9.1 requires POST requests for the affected HTTP endpoints.

A security hardening since Jenkins 2.287 and LTS 2.277.2 prevents exploitation of this vulnerability.

Database specific 
{
    "nvd_published_at": "2021-04-07T14:15:00Z",
    "cwe_ids": [
        "CWE-352"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-13T18:59:35Z"
}
References

Affected packages

Maven / org.jenkins-ci.plugins:promoted-builds

Package

Name
org.jenkins-ci.plugins:promoted-builds
View open source insights on deps.dev
Purl
pkg:maven/org.jenkins-ci.plugins/promoted-builds

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.9.1

Affected versions

2.*

2.0
2.1
2.2
2.3
2.3.1
2.4
2.5
2.6
2.6.1
2.6.2
2.7
2.8
2.9
2.10
2.11
2.12
2.13
2.14
2.15
2.16
2.17
2.18
2.19
2.20
2.21
2.22-beta1
2.22
2.23
2.23.1
2.24
2.24.1
2.25
2.26
2.27
2.28
2.28.1
2.29
2.29.1
2.30
2.31
2.31.1

3.*

3.0
3.1
3.2
3.3
3.4
3.5
3.5.1
3.6
3.7
3.9

Database specific 

{
    "last_known_affected_version_range": "<= 3.9"
}