Cross-site request forgery (CSRF) vulnerability in Jenkins Maven Release Plugin

2022-05-2417:03:46

Google

osv.dev

6.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

33.2%

JSON

A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attackers to have Jenkins connect to an attacker specified web server and parse XML documents.

CPENameOperatorVersion
org.jenkins-ci.plugins.m2release:m2releaseeq0.14.0
org.jenkins-ci.plugins.m2release:m2releaseeq0.13.0
org.jenkins-ci.plugins.m2release:m2releaseeq0.15.0
org.jenkins-ci.plugins.m2release:m2releaseeq0.16.1
org.jenkins-ci.plugins.m2release:m2releaseeq0.11.0
org.jenkins-ci.plugins.m2release:m2releaseeq0.12.0

Name	Operator	Version
org.jenkins-ci.plugins.m2release:m2release	eq	0.14.0
org.jenkins-ci.plugins.m2release:m2release	eq	0.13.0
org.jenkins-ci.plugins.m2release:m2release	eq	0.15.0
org.jenkins-ci.plugins.m2release:m2release	eq	0.16.1
org.jenkins-ci.plugins.m2release:m2release	eq	0.11.0
org.jenkins-ci.plugins.m2release:m2release	eq	0.12.0