CVE-2023-39156: CSRF
A cross-site request forgery (CSRF) vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created Bazaar SCM tags.
Other sources
Jenkins Bazaar Plugin 1.22 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.
This vulnerability allows attackers to delete previously created Bazaar SCM tags.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-39156?
CVE-2023-39156 is a cross-site request forgery (CSRF) vulnerability in Jenkins Bazaar Plugin 1.22 and earlier.
What is the severity of CVE-2023-39156?
The severity of CVE-2023-39156 is medium, with a CVSS score of 5.3.
How does CVE-2023-39156 affect Jenkins Bazaar Plugin?
CVE-2023-39156 allows attackers to delete previously created Bazaar SCM tags in Jenkins Bazaar Plugin 1.22 and earlier.
How can I fix CVE-2023-39156?
To fix CVE-2023-39156, update Jenkins Bazaar Plugin to a version later than 1.22.
Where can I find more information about CVE-2023-39156?
You can find more information about CVE-2023-39156 on the Jenkins website, Openwall mailing list, and NVD.