medium4.3
CVE-2023-32978
Jenkins LDAP Plugin vulnerable to Cross-Site Request Forgery
Impact
Jenkins LDAP Plugin 673.v034ec70ec2b_b_ and earlier does not require POST requests for a form validation method, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to connect to an attacker-specified LDAP server using attacker-specified credentials. LDAP Plugin 676.vfa_64cf6b_b_002 requires POST requests for the affected form validation method.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:ldap | < 676.vfa | 676.vfa |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Lightweight Directory Access Protocol | before 673.v034ec70ec2b_b |