| Package | Affected versions | Patched versions |
|---|---|---|
| hudson.plugins:project-inheritance | < 19.08.2 | 19.08.2 |
| project inheritance | ≤ 19.08.01 |
Project Inheritance Plugin allows the creation of projects based on templates defined in the plugin configuration.
A missing permission check in the HTTP endpoint triggering project creation allowed users with Overall/Read permission to create these projects. Additionally, the HTTP endpoint did not require POST requests, resulting in a CSRF vulnerability.
The HTTP endpoint triggering project creation now requires Item/Create permission and submission of requests via POST.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free