CSRF vulnerability and missing permission check in Jenkins JiraTestResultReporter Plugin

2022-03-3000:00:25

Google

osv.dev

0.001 Low

EPSS

Percentile

34.5%

JSON

A cross-site request forgery (CSRF) vulnerability in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.

CPENameOperatorVersion
org.jenkins-ci.plugins:jiratestresultreportereq2.0.8
org.jenkins-ci.plugins:jiratestresultreportereq2.0.10
org.jenkins-ci.plugins:jiratestresultreportereq2.0.4
org.jenkins-ci.plugins:jiratestresultreportereq2.0.11
org.jenkins-ci.plugins:jiratestresultreportereq1.0.4
org.jenkins-ci.plugins:jiratestresultreportereq2.0.0
org.jenkins-ci.plugins:jiratestresultreportereq2.0.12
org.jenkins-ci.plugins:jiratestresultreportereq2.0.9
org.jenkins-ci.plugins:jiratestresultreportereq2.0.7
org.jenkins-ci.plugins:jiratestresultreportereq2.0.1

Name	Operator	Version
org.jenkins-ci.plugins:jiratestresultreporter	eq	2.0.8
org.jenkins-ci.plugins:jiratestresultreporter	eq	2.0.10
org.jenkins-ci.plugins:jiratestresultreporter	eq	2.0.4
org.jenkins-ci.plugins:jiratestresultreporter	eq	2.0.11
org.jenkins-ci.plugins:jiratestresultreporter	eq	1.0.4
org.jenkins-ci.plugins:jiratestresultreporter	eq	2.0.0
org.jenkins-ci.plugins:jiratestresultreporter	eq	2.0.12
org.jenkins-ci.plugins:jiratestresultreporter	eq	2.0.9
org.jenkins-ci.plugins:jiratestresultreporter	eq	2.0.7
org.jenkins-ci.plugins:jiratestresultreporter	eq	2.0.1