GHSA-w24g-24qg-v4w2

Suggest an improvement
Source
https://github.com/advisories/GHSA-w24g-24qg-v4w2
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-w24g-24qg-v4w2/GHSA-w24g-24qg-v4w2.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-w24g-24qg-v4w2
Aliases
Published
2022-05-24T17:45:44Z
Modified
2024-02-16T08:22:14.747414Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
CSRF vulnerability in Jenkins Build With Parameters Plugin
Details

Jenkins Build With Parameters Plugin 1.5 and earlier does not require POST requests for its form submission endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to build a project with attacker-specified parameters. Build With Parameters Plugin 1.5.1 requires POST requests for the affected HTTP endpoint.

Database specific 
{
    "nvd_published_at": "2021-03-30T12:16:00Z",
    "cwe_ids": [
        "CWE-352"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-15T17:29:07Z"
}
References

Affected packages

Maven / org.jenkins-ci.plugins:build-with-parameters

Package

Name
org.jenkins-ci.plugins:build-with-parameters
View open source insights on deps.dev
Purl
pkg:maven/org.jenkins-ci.plugins/build-with-parameters

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.5.1

Affected versions

1.*

1.1
1.2
1.3
1.4
1.5

Database specific 

{
    "last_known_affected_version_range": "<= 1.5"
}