CSRF vulnerability in Jenkins Netsparker Enterprise Scan Plugin

2022-05-1301:31:33

Google

osv.dev

6.6 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.3%

JSON

A cross-site request forgery vulnerability in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpl#doValidateAPI form validation method allowed attackers to initiate a connection to an attacker-specified server.

CPENameOperatorVersion
org.jenkins-ci.plugins:netsparker-cloud-scaneq1.1.5
org.jenkins-ci.plugins:netsparker-cloud-scaneq1.1.1
org.jenkins-ci.plugins:netsparker-cloud-scaneq1.1.0
org.jenkins-ci.plugins:netsparker-cloud-scaneq1.1.3
org.jenkins-ci.plugins:netsparker-cloud-scaneq1.1.2

Name	Operator	Version
org.jenkins-ci.plugins:netsparker-cloud-scan	eq	1.1.5
org.jenkins-ci.plugins:netsparker-cloud-scan	eq	1.1.1
org.jenkins-ci.plugins:netsparker-cloud-scan	eq	1.1.0
org.jenkins-ci.plugins:netsparker-cloud-scan	eq	1.1.3
org.jenkins-ci.plugins:netsparker-cloud-scan	eq	1.1.2