Cross-site Request Forgery (CSRF) Affecting org.jenkins-ci.plugins:zephyr-for-jira-test-management package, versions [0,]
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGJENKINSCIPLUGINS-575281
- published 3 Jul 2020
- disclosed 3 Jul 2020
- credit Daniel Beck, CloudBees, Inc.
Introduced: 3 Jul 2020
CVE-2020-2215 Open this link in a new tabHow to fix?
There is no fixed version for org.jenkins-ci.plugins:zephyr-for-jira-test-management.
Overview
org.jenkins-ci.plugins:zephyr-for-jira-test-management is a Jenkins plugin that integrates Jenkins and Zephyr for JIRA – Test Management for JIRA Cloud and JIRA Server / Data Center deployments.
Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF). No permission check is perfromed in a method implementing form validation. This allows users with Overall/Read access to Jenkins to connect to an attacker-specified host using attacker-specified username and password.
Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
NOTE: This vulnerability has also been identified as: CVE-2020-2216