CSRF vulnerability in Jenkins Google Cloud Backup Plugin
Moderate severity
GitHub Reviewed
Published
Jul 28, 2022
to the GitHub Advisory Database
•
Updated Jan 29, 2023
Package
Affected versions
<= 0.6
Patched versions
None
Description
Published by the National Vulnerability Database
Jul 27, 2022
Published to the GitHub Advisory Database
Jul 28, 2022
Reviewed
Aug 11, 2022
Last updated
Jan 29, 2023
A cross-site request forgery (CSRF) vulnerability in Jenkins Google Cloud Backup Plugin 0.6 and earlier does not perform a permission check in an HTTP endpoint.
Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
References