Jenkins Alauda DevOps Pipeline Plugin vulnerable to cross-site request forgery

2022-05-2417:03:48

Google

osv.dev

0.001 Low

EPSS

Percentile

33.0%

JSON

A cross-site request forgery vulnerability in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

CPENameOperatorVersion
com.alauda.jenkins.plugins:alauda-devops-pipelineeq1.0.4
com.alauda.jenkins.plugins:alauda-devops-pipelineeq1.0.0
com.alauda.jenkins.plugins:alauda-devops-pipelineeq1.0.3
com.alauda.jenkins.plugins:alauda-devops-pipelineeq1.0.6
com.alauda.jenkins.plugins:alauda-devops-pipelineeq1.0.2
com.alauda.jenkins.plugins:alauda-devops-pipelineeq2.0.2
com.alauda.jenkins.plugins:alauda-devops-pipelineeq1.0.5
com.alauda.jenkins.plugins:alauda-devops-pipelineeq2.3.1
com.alauda.jenkins.plugins:alauda-devops-pipelineeq2.3.2
com.alauda.jenkins.plugins:alauda-devops-pipelineeq2.0.3

Name	Operator	Version
com.alauda.jenkins.plugins:alauda-devops-pipeline	eq	1.0.4
com.alauda.jenkins.plugins:alauda-devops-pipeline	eq	1.0.0
com.alauda.jenkins.plugins:alauda-devops-pipeline	eq	1.0.3
com.alauda.jenkins.plugins:alauda-devops-pipeline	eq	1.0.6
com.alauda.jenkins.plugins:alauda-devops-pipeline	eq	1.0.2
com.alauda.jenkins.plugins:alauda-devops-pipeline	eq	2.0.2
com.alauda.jenkins.plugins:alauda-devops-pipeline	eq	1.0.5
com.alauda.jenkins.plugins:alauda-devops-pipeline	eq	2.3.1
com.alauda.jenkins.plugins:alauda-devops-pipeline	eq	2.3.2
com.alauda.jenkins.plugins:alauda-devops-pipeline	eq	2.0.3