diff --git a/advisories/github-reviewed/2022/01/GHSA-p92q-7fhh-mq35/GHSA-p92q-7fhh-mq35.json b/advisories/github-reviewed/2022/01/GHSA-p92q-7fhh-mq35/GHSA-p92q-7fhh-mq35.json index 04ae9b427d6..c342342bccb 100644 --- a/advisories/github-reviewed/2022/01/GHSA-p92q-7fhh-mq35/GHSA-p92q-7fhh-mq35.json +++ b/advisories/github-reviewed/2022/01/GHSA-p92q-7fhh-mq35/GHSA-p92q-7fhh-mq35.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-p92q-7fhh-mq35", - "modified": "2022-01-20T14:46:50Z", + "modified": "2023-10-27T19:01:54Z", "published": "2022-01-21T23:37:57Z", "aliases": [ "CVE-2022-20612" ], "summary": "Cross-Site Request Forgery in Jenkins", - "details": "A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.", + "details": "Jenkins 2.329 and earlier, LTS 2.319.1 and earlier does not require POST requests for the HTTP endpoint handling manual build requests when no security realm is set, resulting in a cross-site request forgery (CSRF) vulnerability.\n\nThis vulnerability allows attackers to trigger build of job without parameters.\n\nJenkins 2.330, LTS 2.319.2 requires POST requests for the affected HTTP endpoint.", "severity": [ { "type": "CVSS_V3",