Cross-Site Request Forgery in Jenkins

jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained until restart in most cases, administrators' web browsers could be manipulated to create a large number of user records SECURITY-406...

CVE-2017-2613

CVE-2017-2613 concerns Jenkins where certain admin GET actions can trigger CSRF to create users. Affected products/versions: Jenkins core vulnerable before 2.44 and 2.32.x before 2.32.2 (also affecting related Jenkins products in advisories). Root cause: possible CSRF via HTTP GET that enables cr...