Описание
CSRF vulnerability in Jenkins Katalon Plugin allows capturing credentials
Katalon Plugin 1.0.33 and earlier does not require POST requests for several HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities.
This vulnerability allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Katalon Plugin 1.0.34 requires POST requests for the affected HTTP endpoints.
Пакеты
org.jenkins-ci.plugins:katalon
< 1.0.34
1.0.34
Связанные уязвимости
A cross-site request forgery (CSRF) vulnerability in Jenkins Katalon Plugin 1.0.33 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.