CSRF vulnerability in Jenkins Configuration Slicing Plugin

2022-05-2417:43:00

Google

osv.dev

0.001 Low

EPSS

Percentile

33.0%

JSON

Jenkins Configuration Slicing Plugin 1.51 and earlier does not require POST requests for the form submission endpoint reconfiguring slices, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to apply different slice configurations to attacker-specified jobs.

Jenkins Configuration Slicing Plugin 1.52 requires POST requests for the affected HTTP endpoint.

CPENameOperatorVersion
org.jenkins-ci.plugins:configurationslicingeq1.40
org.jenkins-ci.plugins:configurationslicingeq1.51
org.jenkins-ci.plugins:configurationslicingeq1.39
org.jenkins-ci.plugins:configurationslicingeq1.50
org.jenkins-ci.plugins:configurationslicingeq1.44
org.jenkins-ci.plugins:configurationslicingeq1.47
org.jenkins-ci.plugins:configurationslicingeq1.41
org.jenkins-ci.plugins:configurationslicingeq1.45

Name	Operator	Version
org.jenkins-ci.plugins:configurationslicing	eq	1.40
org.jenkins-ci.plugins:configurationslicing	eq	1.51
org.jenkins-ci.plugins:configurationslicing	eq	1.39
org.jenkins-ci.plugins:configurationslicing	eq	1.50
org.jenkins-ci.plugins:configurationslicing	eq	1.44
org.jenkins-ci.plugins:configurationslicing	eq	1.47
org.jenkins-ci.plugins:configurationslicing	eq	1.41
org.jenkins-ci.plugins:configurationslicing	eq	1.45