GHSA-rf8w-7c3g-7h3g

Suggest an improvement
Source
https://github.com/advisories/GHSA-rf8w-7c3g-7h3g
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-rf8w-7c3g-7h3g/GHSA-rf8w-7c3g-7h3g.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-rf8w-7c3g-7h3g
Aliases
Published
2026-05-27T15:33:27Z
Modified
2026-07-01T20:11:28Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Jenkins GitHub Integration Plugin has a cross-site request forgery (CSRF) vulnerability
Details

Jenkins GitHub Integration Plugin 0.7.3 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to trigger a build for a pull request.

GitHub Integration Plugin 0.7.4 requires POST requests for the affected HTTP endpoint.

Database specific 
{
    "cwe_ids":  [
        "CWE-352"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-01T19:44:21Z",
    "nvd_published_at":  "2026-05-27T15:16:32Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven / org.jenkins-ci.plugins:github-integration-parent

Package

Name
org.jenkins-ci.plugins:github-integration-parent
View open source insights on deps.dev
Purl
pkg:maven/org.jenkins-ci.plugins/github-integration-parent

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.7.4

Affected versions

0.*
0.0.1-beta15
0.0.1-beta16
0.0.1-beta17
0.0.1-rc1
0.0.1-rc2
0.0.1-rc3
0.0.1-rc4
0.0.1-rc5
0.1.0-rc6
0.1.0-rc7
0.1.0-rc8
0.1.0-rc9
0.1.0-rc10
0.1.0-rc11
0.1.0-rc12
0.1.0-rc13
0.1.0-rc14
0.1.0-rc15
0.1.0-rc16
0.1.0-rc17
0.1.0-rc18
0.1.0-rc19
0.1.0-rc20
0.1.0-rc21
0.1.0-rc22
0.1.0-rc23
0.1.0-rc24
0.1.0-rc25
0.1.0-rc26
0.1.0-rc27
0.1.0-rc28
0.1.0-rc29
0.2.0-alpha-1
0.2.0-alpha-2
0.2.0-alpha-3
0.2.0-rc-1
0.2.0-rc-2
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7
0.2.8
0.3.0
0.4.0
0.5.0
0.6.1
0.7.0
0.7.1
0.7.2
0.7.3

Database specific

last_known_affected_version_range 
"<= 0.7.3"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-rf8w-7c3g-7h3g/GHSA-rf8w-7c3g-7h3g.json"