Описание
Jenkins Rundeck Plugin CSRF vulnerability
Jenkins Rundeck Plugin does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to initiate a connection test to an attacker-specified server with attacker-specified username and password.
Additionally, the form validation method does not require POST requests, resulting in a CSRF vulnerability.
Пакеты
Наименование
org.jenkins-ci.plugins:rundeck
maven
Затронутые версииВерсия исправления
<= 3.6.5
3.6.6
Связанные уязвимости
CVSS3: 4.3
nvd
больше 6 лет назад
A cross-site request forgery vulnerability in Jenkins Rundeck Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials.