| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:electricflow | < 1.1.7 | 1.1.7 |
| electricflow | ≤ 1.1.5 |
A missing permission check in a form validation method in CloudBees CD Plugin allowed users with Overall/Read permission to initiate a connection test to an attacker-specified server with attacker-specified username and password.
Additionally, the form validation method did not require POST requests, resulting in a CSRF vulnerability.
This form validation method now requires POST requests and Overall/Administer permissions.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free