CVE-2022-29048

MEDIUM4.3EPSS 0.20%

CSRF vulnerability in Jenkins Subversion Plugin

Published: 4/13/2022Modified: 2/16/2024

Description

Subversion Plugin 2.15.3 and earlier does not require POST requests for several form validation methods, resulting in cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow attackers to connect to an attacker-specified URL.

Affected packages (1)

Maven/org.jenkins-ci.plugins:subversionfrom 0, < 2.15.4

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References (6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-29048
PATCHhttps://github.com/jenkinsci/subversion-plugin
WEBhttp://seclists.org/fulldisclosure/2022/Jul/18
WEBhttps://github.com/jenkinsci/subversion-plugin/commit/882a7d359f6ac73c53d787bff4d62eba837001ea
WEBhttps://support.apple.com/kb/HT213345
WEBhttps://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2075