CSRF vulnerability in Jenkins kubernetes-cd Plugin allow capturing credentials
High severity
GitHub Reviewed
Published
Mar 16, 2022
to the GitHub Advisory Database
•
Updated Feb 2, 2023
Package
Affected versions
<= 2.3.1
Patched versions
None
Description
Published by the National Vulnerability Database
Mar 15, 2022
Published to the GitHub Advisory Database
Mar 16, 2022
Reviewed
Nov 30, 2022
Last updated
Feb 2, 2023
A cross-site request forgery (CSRF) vulnerability in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
References