GHSA-64c5-r2h5-c2fg

ghsaUSosv

Jenkins docker-build-step Plugin Cross-Site Request Forgery vulnerability

view advisory published 2024-03-06Licence: CC-BY-4.0

A cross-site request forgery (CSRF) vulnerability in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting future build step executions.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-2215US	—	0.41% (35th)	—	2024-03-06
A cross-site request forgery (CSRF) vulnerability in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers to connect to an attacker-specified TCP or Unix socket URL,…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2024/03/06/3WEB
https://github.com/jenkinsci/docker-build-step-pluginPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2024-2215ADVISORY
https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3200WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan