CSRF vulnerability in Jenkins CloudBees AWS Credentials Plugin

2022-03-1600:00:44

Google

osv.dev

jenkins

cloudbees

aws

csrf

vulnerability

plugin

attackers

permission

aws service

token

EPSS

0.001

Percentile

29.9%

JSON

A cross-site request forgery (CSRF) vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.

References

www.openwall.com/lists/oss-security/2022/03/15/2

github.com/jenkinsci/aws-credentials-plugin

github.com/jenkinsci/aws-credentials-plugin/commit/cbf183ce58b955f17d93fdc1ac4d19a8ebe693db

nvd.nist.gov/vuln/detail/CVE-2022-27198

www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2351

EPSS

0.001

Percentile

29.9%

JSON

Related for OSV:GHSA-PV4M-7C68-F4C5