CVE-2020-2184 - A cross-site request forgery vulnerability in Jenkins CVS Plugin 2.15 and earlier allows attackers to create and manipulate tags, and to connect to an attacker-specified URL

Back Back to CVE browser

MEDIUM

A cross-site request forgery vulnerability in Jenkins CVS Plugin 2.15 and earlier allows attackers to create and manipulate tags, and to connect to an attacker-specified URL

Published May 6, 2020

4.3

MEDIUM

CVSS 3.1

EPSS 44.46%

Description

A cross-site request forgery vulnerability in Jenkins CVS Plugin 2.15 and earlier allows attackers to create and manipulate tags, and to connect to an attacker-specified URL.

Affected products

Vendor Jenkins project Product Jenkins CVS Plugin Default
unknown
Affected
- ≥ unspecified, ≤ 2.15

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Jenkins project	Jenkins CVS Plugin	unknown	Affected ≥ unspecified, ≤ 2.15

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (6)

http://www.openwall.com/lists/oss-security/2020/05/06/3
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2703
Advisory
https://github.com/advisories/GHSA-63mw-hp3h-gc77
Advisory
https://github.com/jenkinsci/cvs-plugin/commit/8954b3a1e498f11c09296d4f54dc2de6a371c448
https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1094
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-2184

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2020/05/06/3		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2703		Advisory
https://github.com/advisories/GHSA-63mw-hp3h-gc77		Advisory
https://github.com/jenkinsci/cvs-plugin/commit/8954b3a1e498f11c09296d4f54dc2de6a371c448
https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1094		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-2184