Medium · 4.3 CVE-2022-27204 EUVD-2022-1418GHSA-fqpx-xfjr-2qr9

CSRF vulnerability and missing permission checks in Jenkins Extended Choice Parameter Plugin allow SSRF

Published Mar 15, 2022 · Updated Aug 3, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Extended Choice Parameter Plugin Package: org.jenkins-ci.plugins:extended-choice-parameter Category: Web / CMS Ecosystem: Maven

Description

A cross-site request forgery vulnerability in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers to connect to an attacker-specified URL.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins Extended Choice Parameter Plugin	unspecified – ≤ 346.vd87693c5a_86c	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jenkins-ci.plugins:extended-choice-parameter	< 356.va_90a_94ca_62ec	356.va_90a_94ca_62ec	GHSA-fqpx-xfjr-2qr9

References

https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-1350
[oss-security] 20220315 Multiple vulnerabilities in Jenkins plugins mailing-list