PkgSeer

Vulnerability GHSA-9cfq-v2hm-c3xr

Medium Risk

4 years ago

Jenkins GitHub Branch Source Plugin vulnerable to Server-Side Request Forgery

1.0.0 - 1.10.1

Summary

Jenkins GitHub Branch Source Plugin vulnerable to Server-Side Request Forgery

Details

A server-side request forgery vulnerability exists in Jenkins GitHub Branch Source Plugin 2.3.4 and older in Endpoint.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL. Additionally, this form validation method did not require POST requests, resulting in a CSRF vulnerability. As of version 23.5, this form validation method requires POST requests and the Overall/Administer permission.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs

1.0.0 - 1.10.1 and 2.4.5 - 2.4.6 and 2.6.0 and 2.8.0 and 2.8.2 - 2.8.3 and 2.9.9 GHSA-g7c6-wxjf-8564

Jenkins GitHub Branch Source Plugin: Missing permissions check allows attackers to perform a connection test

1.0.0 - 1.10.1 and 2.4.5 - 2.4.6 and 2.6.0 and 2.8.0 and 2.8.2 - 2.8.3 and 2.9.9 GHSA-wg26-8wmj-cf9p

Jenkins GitHub Branch Source Plugin vulnerable to Cross-Site Request Forgery

1.0.0 - 1.10.1 GHSA-w66r-f5gg-gqwm

Jenkins GitHub Branch Source Plugin allows any user with Overall/Read permission to get list of valid credentials IDs

1.0.0 - 1.10.1 GHSA-6jp2-hggx-8j7p

View all vulnerabilities for these packages

Impacted packages

org.jenkins-ci.plugins:github-branch-source

Timeline

Published

4 years ago

Last Modified

2 years ago