GHSA-7ccg-jm7j-4f8v

ghsaUSosv

Cross-site request forgery vulnerability in Jenkins HTMLResource Plugin

view advisory published 2023-12-13Licence: CC-BY-4.0

A cross-site request forgery (CSRF) vulnerability in Jenkins HTMLResource Plugin 1.02 and earlier allows attackers to delete arbitrary files on the Jenkins controller file system.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-50774US	high8.1	0.49% (42nd)	—	2023-12-13
A cross-site request forgery (CSRF) vulnerability in Jenkins HTMLResource Plugin 1.02 and earlier allows attackers to delete arbitrary files on the Jenkins controller file system.

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2023/12/13/4WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-50774ADVISORY
https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3183WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan