Jenkins Build Failure Analyzer Plugin Cross-Site Request Forgery vulnerability
Moderate severity
GitHub Reviewed
Published
Sep 20, 2023
to the GitHub Advisory Database
•
Updated Jan 4, 2024
Package
Affected versions
< 2.4.2
Patched versions
2.4.2
Description
Published by the National Vulnerability Database
Sep 20, 2023
Published to the GitHub Advisory Database
Sep 20, 2023
Reviewed
Sep 21, 2023
Last updated
Jan 4, 2024
Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not require POST requests for an HTTP endpoint, resulting in cross-site request forgery (CSRF) vulnerabilities.
This vulnerability allows attackers to delete Failure Causes.
Build Failure Analyzer Plugin 2.4.2 requires POST requests for the affected HTTP endpoint.
References