Description
jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained until restart in most cases, administrators' web browsers could be manipulated to create a large number of user records (SECURITY-406).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| [UNKNOWN] | jenkins | jenkins 2.44, jenkins 2.32.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | < 2.32.2 | 2.32.2 | GHSA-pwv6-872c-gcg6 |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.34, < 2.44 | 2.44 | GHSA-pwv6-872c-gcg6 |