Jenkins Maven Release Plugin contains Cross-Site Request Forgery vulnerability

2022-05-2416:51:50

Google

osv.dev

0.001 Low

EPSS

Percentile

26.2%

JSON

A cross-site request forgery vulnerability in Jenkins Maven Release Plugin prior to 0.15.0 in the M2ReleaseAction#doSubmit method allowed attackers to perform releases with attacker-specified options.

CPENameOperatorVersion
org.jenkins-ci.plugins.m2release:m2releaseeq0.14.0
org.jenkins-ci.plugins.m2release:m2releaseeq0.11.0
org.jenkins-ci.plugins.m2release:m2releaseeq0.12.0
org.jenkins-ci.plugins.m2release:m2releaseeq0.13.0

Name	Operator	Version
org.jenkins-ci.plugins.m2release:m2release	eq	0.14.0
org.jenkins-ci.plugins.m2release:m2release	eq	0.11.0
org.jenkins-ci.plugins.m2release:m2release	eq	0.12.0
org.jenkins-ci.plugins.m2release:m2release	eq	0.13.0