Skip to content
Sign in
8.8 High

CVE-2023-24434 A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier…

Description

A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Affected products and versions

Product Affected versions Fixed in
Jenkins GitHub Pull Request Builder Plugin 1.42 earliest → 1.42.2 No fix stated

Other CVEs of Jenkins GitHub Pull Request Builder Plugin

The 3 CVEs of Jenkins GitHub Pull Request Builder Plugin →
CVE-2023-24435 A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with… 6.5 Medium CVE-2023-24436 A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with… 4.3 Medium
Track this CVE