Lucene search

GitHub Advisory DatabaseGHSA-4V5C-5V6C-37PJ

HistoryJul 01, 2022 - 12:01 a.m.

Jenkins Matrix Reloaded Plugin vulnerable to CSRF

2022-07-0100:01:07

CWE-352

GitHub Advisory Database

github.com

jenkins

matrix reloaded plugin

csrf

vulnerability

http endpoint

attackers

matrix builds

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

21.6%

JSON

Jenkins Matrix Reloaded Plugin 1.1.3 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to rebuild previous matrix builds.

Affected configurations

Vulners

Node

net.praqma\matrixMatchreloaded

References

github.com/advisories/GHSA-4v5c-5v6c-37pj

nvd.nist.gov/vuln/detail/CVE-2022-34789

www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2016

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

21.6%

JSON

Related for GHSA-4V5C-5V6C-37PJ