| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:extended-choice-parameter | ≤ 346.vd87693c5a | |
| extended choice parameter | ≤ 346.vd87693c5a_86c |
Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not perform a permission check on form validation methods. This allows attackers with Overall/Read permission to connect to an attacker-specified URL.
Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free