GHSA-7c3v-2jjv-hq3c

ghsaUSosv

Cross-Site Request Forgery in Jenkins Autocomplete Parameter Plugin

view advisory published 2022-05-18Licence: CC-BY-4.0

A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute arbitrary code without sandbox protection if the victim is an administrator.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-30969US	high8.8	0.92% (60th)	—	2022-05-17
A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute arbitrary code without sandbox protection if…

references

External citations — patches, advisories, analysis.

https://github.com/jenkinsci/autocomplete-parameter-pluginPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2022-30969ADVISORY
https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2322WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan