Description

A cross-site request forgery (CSRF) vulnerability in Jenkins SCM HttpClient Plugin 1.5 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Remediation

References

http://www.openwall.com/lists/oss-security/2022/09/21/5

https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2708

Related Vulnerabilities

CVE-2019-1003031 Vulnerability in maven package org.jenkins-ci.plugins:matrix-project

CVE-2019-11272 Vulnerability in maven package org.springframework.security:spring-security-core

CVE-2021-36151 Vulnerability in maven package org.apache.gobblin:gobblin-core

CVE-2023-22665 Vulnerability in maven package org.apache.jena:jena-arq

CVE-2019-19771 Vulnerability in npm package babel-loqder

Severity

Critical

Classification

CWE-352 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory Vendor Advisory