CSRF vulnerability in Jenkins kubernetes-cd Plugin allow capturing credentials

2022-03-1600:00:43

Google

osv.dev

0.001 Low

EPSS

Percentile

34.8%

JSON

A cross-site request forgery (CSRF) vulnerability in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

CPENameOperatorVersion
org.jenkins-ci.plugins:kubernetes-cdeq0.2.1
org.jenkins-ci.plugins:kubernetes-cdeq0.1.5
org.jenkins-ci.plugins:kubernetes-cdeq2.0.0
org.jenkins-ci.plugins:kubernetes-cdeq0.1.3
org.jenkins-ci.plugins:kubernetes-cdeq0.2.3
org.jenkins-ci.plugins:kubernetes-cdeq2.0.1
org.jenkins-ci.plugins:kubernetes-cdeq2.2.0
org.jenkins-ci.plugins:kubernetes-cdeq0.1.1
org.jenkins-ci.plugins:kubernetes-cdeq1.0.0
org.jenkins-ci.plugins:kubernetes-cdeq0.1.2

Name	Operator	Version
org.jenkins-ci.plugins:kubernetes-cd	eq	0.2.1
org.jenkins-ci.plugins:kubernetes-cd	eq	0.1.5
org.jenkins-ci.plugins:kubernetes-cd	eq	2.0.0
org.jenkins-ci.plugins:kubernetes-cd	eq	0.1.3
org.jenkins-ci.plugins:kubernetes-cd	eq	0.2.3
org.jenkins-ci.plugins:kubernetes-cd	eq	2.0.1
org.jenkins-ci.plugins:kubernetes-cd	eq	2.2.0
org.jenkins-ci.plugins:kubernetes-cd	eq	0.1.1
org.jenkins-ci.plugins:kubernetes-cd	eq	1.0.0
org.jenkins-ci.plugins:kubernetes-cd	eq	0.1.2