Description
Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to add administrator role to any user, or to remove the authorization configuration, preventing legitimate access to Jenkins.
Remediation
References
https://jenkins.io/security/advisory/2017-07-10/
Related Vulnerabilities
CVE-2023-3223 Vulnerability in maven package io.undertow:undertow-servlet
CVE-2020-9486 Vulnerability in maven package org.apache.nifi:nifi-security-utils
CVE-2023-29019 Vulnerability in npm package @fastify/passport
CVE-2022-38179 Vulnerability in maven package io.ktor:ktor-utils
CVE-2023-40037 Vulnerability in maven package org.apache.nifi:nifi-dbcp-base