Jenkins Docker Plugin contains Cross-Site Request Forgery
High severity
GitHub Reviewed
Published
May 24, 2022
to the GitHub Advisory Database
•
Updated Dec 19, 2023
Description
Published by the National Vulnerability Database
Jul 11, 2019
Published to the GitHub Advisory Database
May 24, 2022
Reviewed
Feb 1, 2023
Last updated
Dec 19, 2023
A cross-site request forgery vulnerability in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
References