GHSA-49j4-v37g-5gg2MediumCVSS 4.3

Jenkins EasyQA Plugin Missing Authorization vulnerability

Published
June 24, 2022
Last Modified
October 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-34204 →

📋 Description

Jenkins EasyQA Plugin 1.0 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix.

🎯 Affected products1

  • maven/com.geteasyqa:easyqa:<= 1.0

🔗 References (3)