CVE-2023-24437

published 2023-01-26

CVE-2023-24437: A cross-site request forgery (CSRF) vulnerability in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers to connect to an…

Priority P3 39 high 8.8 CVSS 3.1

AV N AC L PR N UI R S U C H I H A H

A cross-site request forgery (CSRF) vulnerability in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Affected

23 ranges

Vendor	Product	Version range	Fixed in
jenkins	bearychat_plugin	—	—
jenkins	bitbucket_oauth_plugin	—	—
jenkins	cisco_spark_notifier_plugin	—	—
jenkins	gerrit_trigger_plugin	—	—
jenkins	github_pull_request_builder_plugin	—	—
jenkins	github_pull_request_coverage_status_plugin	—	—
jenkins	ids_in_orka_by_macstadium_plugin	—	—
jenkins	jira_pipeline_steps	<= 2.0.165.v8846cf59f3db	—
jenkins	jira_pipeline_steps_plugin	—	—
jenkins	keycloak_authentication_plugin	—	—
jenkins	kubernetes_credentials_provider_plugin	—	—
jenkins	macstadium_plugin	—	—
jenkins	mstest_plugin	—	—
jenkins	openid_connect_authentication_plugin	—	—
jenkins	openid_plugin	—	—
jenkins	orka_by_macstadium_plugin	—	—
jenkins	pwauth_security_realm_plugin	—	—
jenkins	rabbitmq_consumer_plugin	—	—
jenkins	script_security_plugin	—	—
jenkins	semantic_versioning_plugin	—	—
jenkins	testcomplete_support_plugin	—	—
jenkins	testquality_updater_plugin	—	—
jenkins_project	jenkins_jira_pipeline_steps_plugin	unspecified – 2.0.165.v8846cf59f3db	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-352