Jenkins Project Inheritance Plugin vulnerable to Cross-Site Request Forgery

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2019-10408 · ADVISORY
• jenkins.io/security/advisory/2019-09-25 · WEB
• openwall.com/lists/oss-security/2019/09/25/3 · WEB

Lỗ hổng khác của hudson.plugins:project-inheritance

• CVE-2022-34787TRUNG BÌNH 5.4Jenkins Project Inheritance Plugin 21.04.03 and earlier does not escape the reason a build is blocked in tooltips, resulting in a cross-site…
• CVE-2020-2198TRUNG BÌNH 6.5Jenkins Project Inheritance Plugin 19.08.02 and earlier does not redact encrypted secrets in the 'getConfigAsXML' API URL when transmitting …
• CVE-2020-2197TRUNG BÌNH 4.3Jenkins Project Inheritance Plugin 19.08.02 and earlier does not require users to have Job/ExtendedRead permission to access Inheritance Pro…
• CVE-2019-10409TRUNG BÌNH 4.3A missing permission check in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers with Overall/Read permission to trigger…
• CVE-2019-10407TRUNG BÌNH 6.5Jenkins Project Inheritance Plugin 2.0.0 and earlier displayed a list of environment variables passed to a build without masking sensitive v…