| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:build-publisher | ≤ 1.22 | |
| build-publisher | ≤ 1.22 |
A cross-site request forgery (CSRF) vulnerability in Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers to replace any config.xml file on the Jenkins controller file system with an empty file by providing a crafted file name to an API endpoint. There is currently no workaround or patch as this plugin has been suspended.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free