Cross-site Request Forgery (CSRF) Affecting org.jenkins-ci.main:jenkins-core package, versions [,2.400)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGJENKINSCIMAIN-5710355
- published 15 Jun 2023
- disclosed 14 Jun 2023
- credit Kevin Guerroudj (CloudBees)
Introduced: 14 Jun 2023
CVE-2023-35141 Open this link in a new tabHow to fix?
Upgrade org.jenkins-ci.main:jenkins-core to version 2.400 or higher.
Overview
org.jenkins-ci.main:jenkins-core is an open source automation server.
Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via context menus for e.g. links to jobs and builds, or breadcrumbs. POST requests are sent in order to load the list of context actions. If part of the URL includes insufficiently escaped user-provided values, a victim may be tricked into sending a POST request to an unexpected endpoint (e.g. the Script Console) by opening a context menu.
Users with Item/Configure permissions can use label expressions to bypass CSRF protections.