CVE-2017-1000090

Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to add administrator role to any user, or to remove the authorization configuration, preventing legitimate access t...

PT-2017-10795

Name of the Vulnerable Software and Affected Versions Jenkins Role-based Authorization Strategy Plugin affected versions not specified Description The issue allows attackers to perform Cross-Site Request Forgery attacks due to the plugin not requiring requests to its API to be sent via POST. This...