CSRF vulnerability in ivy

ivy 2.5 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to delete disabled modules. As of publication of this advisory, there is no fix. Learn why we announce this...

PT-2023-28176 · Jenkins · Jenkins Ivy Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Ivy Plugin versions 2.5 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to delete disabled modules. Recommendations: For Jenkins Ivy Plugin versions 2.5 and earlier, update to a version later...