Опубликовано: 06 мар. 2024
Источник: github
Github: Прошло ревью
CVSS4: 5.3
CVSS3: 6.3
Описание
Jenkins docker-build-step Plugin Cross-Site Request Forgery vulnerability
A cross-site request forgery (CSRF) vulnerability in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting future build step executions.
Пакеты
Наименование
org.jenkins-ci.plugins:docker-build-step
maven
Затронутые версииВерсия исправления
<= 2.11
Отсутствует
Связанные уязвимости
CVSS3: 6.1
nvd
почти 2 года назад
A cross-site request forgery (CSRF) vulnerability in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting future build step executions.