GHSA-cp6q-836q-gmj3

Source

https://github.com/advisories/GHSA-cp6q-836q-gmj3

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-cp6q-836q-gmj3/GHSA-cp6q-836q-gmj3.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-cp6q-836q-gmj3

Aliases

CVE-2022-34817

Published

2022-07-01T00:01:08Z

Modified

2023-11-08T04:09:48.904477Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Cross-Site Request Forgery in Jenkins Failed Job Deactivator Plugin

Details

A cross-site request forgery (CSRF) vulnerability in Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier allows attackers to disable jobs. This CSRF vulnerability is only exploitable in Jenkins 2.286 and earlier, LTS 2.277.1 and earlier. See the LTS upgrade guide.

Database specific

{
    "nvd_published_at": "2022-06-30T18:15:00Z",
    "github_reviewed_at": "2022-07-12T18:14:08Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-352"
    ]
}

References

Affected packages

Maven / de.einsundeins.jenkins.plugins.failedjobdeactivator:failedJobDeactivator

Package

Name: de.einsundeins.jenkins.plugins.failedjobdeactivator:failedJobDeactivator; View open source insights on deps.dev
Purl: pkg:maven/de.einsundeins.jenkins.plugins.failedjobdeactivator/failedJobDeactivator

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.2.1

Affected versions

1.*

1.0

1.1

1.1.1

1.1.2

1.2

1.2.1