GHSA-3vhr-f5xr-8vpx

Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack

At a glance

Published: 2022-05-13 01:30 UTC
Updated: 2025-03-13 18:40 UTC
CVE: CVE-2015-7537
CVSS_V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method.

Affected packages

Package	Versions
Maven · org.jenkins-ci.main:jenkins-core	introduced 1.626, fixed 1.640
Maven · org.jenkins-ci.main:jenkins-core	introduced 0, fixed 1.625.2

References

https://nvd.nist.gov/vuln/detail/CVE-2015-7537 ADVISORY
https://github.com/jenkinsci/jenkins/commit/40a28999e221a209212c30586be9c39049510bd1 WEB
https://access.redhat.com/errata/RHSA-2016:0070 WEB
https://github.com/jenkinsci/jenkins PACKAGE
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09 WEB
http://rhn.redhat.com/errata/RHSA-2016-0489.html WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database