Description

A cross-site request forgery (CSRF) vulnerability in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers to connect to an attacker-specified database via JDBC using attacker-specified credentials and to determine if a class is available in the Jenkins instance.

Remediation

References

https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2177

Related Vulnerabilities

CVE-2023-28683 Vulnerability in maven package org.jenkins-ci.plugins:phabricator-plugin

CVE-2023-45818 Vulnerability in npm package tinymce

CVE-2022-24891 Vulnerability in maven package org.owasp.esapi:esapi

CVE-2022-36537 Vulnerability in maven package org.zkoss.zk:zk

CVE-2022-23458 Vulnerability in npm package tui-grid

Severity

Critical

Classification

CWE-352 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Issue Tracking Patch Vendor Advisory