Описание
Jenkins XebiaLabs XL Deploy Plugin vulnerable to Cross-site request forgery (CSRF)
A missing permission check in a form validation method in Jenkins XebiaLabs XL Deploy Plugin allows users with Overall/Read permission to initiate a connection test to an attacker-specified server with attacker-specified credentials.
Additionally, the form validation method does not require POST requests, resulting in a CSRF vulnerability.
Пакеты
Наименование
com.xebialabs.deployit.ci:deployit-plugin
maven
Затронутые версииВерсия исправления
< 7.5.5
7.5.5
Связанные уязвимости
CVSS3: 6.5
nvd
почти 7 лет назад
A cross-site request forgery vulnerability in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows attackers to initiate a connection to an attacker-specified server.