Description

A cross-site request forgery vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier in the M2ReleaseAction#doSubmit method allowed attackers to perform releases with attacker-specified options.

Remediation

References

https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1098

http://www.openwall.com/lists/oss-security/2019/07/31/1

Related Vulnerabilities

CVE-2023-37946 Vulnerability in maven package org.openshift.jenkins:openshift-login

CVE-2022-26594 Vulnerability in maven package com.liferay:com.liferay.dynamic.data.mapping.form.field.type

CVE-2022-23107 Vulnerability in maven package io.jenkins.plugins:warnings-ng

CVE-2012-4386 Vulnerability in maven package org.apache.struts:struts2-core

CVE-2022-34662 Vulnerability in maven package org.apache.dolphinscheduler:dolphinscheduler-common

Severity

High

Classification

CWE-352 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Tags

Vendor Advisory Mailing List Third Party Advisory