MEDIUM5.4
GHSA-429r-3j78-2pxm
Jenkins Assembla Plugin has a cross-site request forgery (CSRF) vulnerability
Details
Jenkins Assembla Plugin 1.4 and earlier does not perform a permission check in an HTTP endpoint that tests the connection to an Assembla server.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password.
Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
As of publication of this advisory, there is no fix.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/org.jenkins-ci.plugins:assembla
Introduced in:
0No fixed version published yet for org.jenkins-ci.plugins:assembla (maven). Pin to a known-safe version or switch to an alternative.