CSRF vulnerability in ec2-deployment-dashboard

ec2-deployment-dashboard 1.0.10 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to copy jobs. As of publication of this advisory, there is no fix. Learn why we announce this...

PT-2019-11315 · Jenkins · Jenkins Job Import Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Job Import Plugin versions 3.0 and earlier Description: A data modification issue exists that allows attackers to copy jobs from another Jenkins instance, potentially installing additional plugins to load the imported job's...