Medium · 4.3 CVE-2023-43502 EUVD-2023-2398GHSA-2wwh-qgh8-w9xw

Jenkins Build Failure Analyzer Plugin Cross-Site Request Forgery vulnerability

Published Sep 20, 2023 · Updated Sep 24, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Build Failure Analyzer Plugin Package: com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer Category: Web / CMS Ecosystem: Maven

Description

A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to delete Failure Causes.

Affected products

Vendor	Product	Affected	Fixed
Jenkins Project	Jenkins Build Failure Analyzer Plugin	≤ 2.4.1	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer	< 2.4.2	2.4.2	GHSA-2wwh-qgh8-w9xw

Advisories 1

WID-SEC-2023-2411 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 20, 2023

References

Jenkins Security Advisory 2023-09-20 vendor-advisory
http://www.openwall.com/lists/oss-security/2023/09/20/5