Описание
Jenkins LDAP Plugin vulnerable to Cross-Site Request Forgery
Jenkins LDAP Plugin 673.v034ec70ec2b_b_ and earlier does not require POST requests for a form validation method, resulting in a cross-site request forgery (CSRF) vulnerability.
This vulnerability allows attackers to connect to an attacker-specified LDAP server using attacker-specified credentials.
LDAP Plugin 676.vfa_64cf6b_b_002 requires POST requests for the affected form validation method.
Пакеты
Наименование
org.jenkins-ci.plugins:ldap
maven
Затронутые версииВерсия исправления
< 676.vfa
676.vfa
Связанные уязвимости
CVSS3: 4.3
nvd
больше 2 лет назад
A cross-site request forgery (CSRF) vulnerability in Jenkins LDAP Plugin allows attackers to connect to an attacker-specified LDAP server using attacker-specified credentials.