Описание
Cross site request forgery in Jenkins Job and Node ownership Plugin
Job and Node ownership Plugin 0.13.0 and earlier does not perform a permission check in several HTTP endpoints. This allows attackers with Item/Read permission to change the owners and item-specific permissions of a job. Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Пакеты
Наименование
com.synopsys.jenkinsci:ownership
maven
Затронутые версииВерсия исправления
<= 0.13.0
Отсутствует
Связанные уязвимости
CVSS3: 8.8
nvd
почти 4 года назад
A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to change the owners and item-specific permissions of a job.