Medium · 6.3 CVE-2019-10359 EUVD-2022-5090GHSA-r4rv-cq77-6p24

Jenkins Maven Release Plugin contains Cross-Site Request Forgery vulnerability

Published Jul 31, 2019 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Maven Release Plugin Package: org.jenkins-ci.plugins.m2release:m2release Category: Web / CMS Ecosystem: Maven

Description

A cross-site request forgery vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier in the M2ReleaseAction#doSubmit method allowed attackers to perform releases with attacker-specified options.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins Maven Release Plugin	0.14.0 and earlier	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jenkins-ci.plugins.m2release:m2release	< 0.15.0	0.15.0	GHSA-r4rv-cq77-6p24

References

[oss-security] 20190731 Multiple vulnerabilities in Jenkins plugins mailing-list
https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1098