GHSA-3vhr-f5xr-8vpx
Jenkins Vulnerable to Cross-Site Request Forgery (CSRF) Attack
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2015-7537
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
Cross-site request forgery (CSRF) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via vectors related to the HTTP GET method.
Paquets affectés
| Paquet | Versions |
|---|---|
| Maven · org.jenkins-ci.main:jenkins-core | introduced 1.626, fixed 1.640 |
| Maven · org.jenkins-ci.main:jenkins-core | introduced 0, fixed 1.625.2 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2015-7537 ADVISORY
- https://github.com/jenkinsci/jenkins/commit/40a28999e221a209212c30586be9c39049510bd1 WEB
- https://access.redhat.com/errata/RHSA-2016:0070 WEB
- https://github.com/jenkinsci/jenkins PACKAGE
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09 WEB
- http://rhn.redhat.com/errata/RHSA-2016-0489.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |