Lucene search
GoogleOSV:GHSA-2PJ6-5HQC-W5X9HistoryFeb 16, 2022 - 12:01 a.m.
CSRF vulnerability in Jenkins SWAMP Plugin allows capturing credentials
2022-02-1600:01:12
Google
osv.dev
12
jenkins
swamp plugin
csrf
vulnerability
credentials
permission check
form validation
overall/read
url
credentials ids
cross-site request forgery
software
EPSS
0.001
Percentile
32.3%
WAMP Plugin 1.2.6 and earlier does not perform a permission check in a method implementing form validation.\
This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Related
prion
prion
Cross site request forgery (csrf)
2022-02-15 17:15:00
cvelist
cvelist
CVE-2022-25212
2022-02-15 16:11:51
nvd
nvd
CVE-2022-25212
2022-02-15 17:15:11
cnvd
cnvd
Jenkins SWAMP Plugin Cross-Site Request Forgery Vulnerability
2022-02-17 00:00:00
osv
osv
CVE-2022-25212
2022-02-15 17:15:11
github
github
CSRF vulnerability in Jenkins SWAMP Plugin allows capturing credentials
2022-02-16 00:01:12
cve
cve
CVE-2022-25212
2022-02-15 17:15:11
