Description
A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.java that allows attackers to create a Git tag in a workspace and attach corresponding metadata to a build record.
Remediation
References
https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1095
https://access.redhat.com/errata/RHBA-2019:0326
https://access.redhat.com/errata/RHBA-2019:0327
Related Vulnerabilities
CVE-2023-33510 Vulnerability in maven package org.jeecgframework.p3:jeecg-p3-biz-chat
CVE-2019-10325 Vulnerability in maven package io.jenkins.plugins:warnings-ng
CVE-2022-24728 Vulnerability in npm package ckeditor4
CVE-2011-1077 Vulnerability in maven package org.apache.archiva:archiva
CVE-2022-25848 Vulnerability in npm package static-dev-server