GHSA-fv3c-6cw7-2qcq

    Dashboard / Vulnerabilities / GHSA-fv3c-6cw7-2qcq

    GHSA-fv3c-6cw7-2qcq

    Published: 17 May 2022Last Modified: 21 Feb 2024

    Summary: Jenkins Poll SCM Plugin vulnerable to Cross-Site Request Forgery

    Details: Jenkins Poll SCM Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to initiate polling of projects with a known name. While Jenkins in general does not consider polling to be a protection-worthy action as it's similar to cache invalidation, the plugin specifically adds a permission to be able to use this functionality, and this issue undermines that permission. This functionality now is only available via POST.

    References: https://nvd.nist.gov/vuln/detail/CVE-2017-1000093, https://github.com/jenkinsci/pollscm-plugin, https://jenkins.io/security/advisory/2017-07-10

    Affected packages

    Package

    Name: org.jenkins-ci.plugins:pollscm

    Purl: pkg:maven/org.jenkins-ci.plugins/pollscm

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.3.1

    Affected versions

    1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-fv3c-6cw7-2qcq | CVE-DB