GHSA-43m2-hcmm-qpm7
Jenkins Zowe zDevOps Plugin has a CSRF vulnerability
Details
Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier does not perform a permission check in an HTTP endpoint implementing a connection test.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
As of publication of this advisory, there is no fix.
Are you affected?
Enter the version of the package you're using.
Affected packages
0No fixed version published yet for io.jenkins.plugins:zdevops (maven). Pin to a known-safe version or switch to an alternative.