CVE-2023-24434: A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to connect to an…

PriorityP339high8.8CVSS 3.1

AVNACLPRNUIRSUCHIHAH

EPSS

0.56%

42.5th percentile

A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Affected

23 ranges

Vendor	Product	Version range	Fixed in
jenkins	bearychat_plugin	—	—
jenkins	bitbucket_oauth_plugin	—	—
jenkins	cisco_spark_notifier_plugin	—	—
jenkins	gerrit_trigger_plugin	—	—
jenkins	github_pull_request_builder	<= 1.42.2	—
jenkins	github_pull_request_builder_plugin	—	—
jenkins	github_pull_request_coverage_status_plugin	—	—
jenkins	ids_in_orka_by_macstadium_plugin	—	—
jenkins	jira_pipeline_steps_plugin	—	—
jenkins	keycloak_authentication_plugin	—	—
jenkins	kubernetes_credentials_provider_plugin	—	—
jenkins	macstadium_plugin	—	—
jenkins	mstest_plugin	—	—
jenkins	openid_connect_authentication_plugin	—	—
jenkins	openid_plugin	—	—
jenkins	orka_by_macstadium_plugin	—	—
jenkins	pwauth_security_realm_plugin	—	—
jenkins	rabbitmq_consumer_plugin	—	—
jenkins	script_security_plugin	—	—
jenkins	semantic_versioning_plugin	—	—
jenkins	testcomplete_support_plugin	—	—
jenkins	testquality_updater_plugin	—	—
jenkins_project	jenkins_github_pull_request_builder_plugin	unspecified – 1.42.2	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.