CVE-2023-30529: Cross-Site Request Forgery (CSRF)

April 12, 2023

Jenkins Lucene-Search Plugin 387.v938a_ecb_f7fe9 and earlier does not require POST requests for an HTTP endpoint, allowing attackers to reindex the database.

References

github.com/advisories/GHSA-gh5w-gffh-68pr
nvd.nist.gov/vuln/detail/CVE-2023-30529
www.jenkins.io/security/advisory/2023-04-12/

Code Behaviors & Features

Detect and mitigate CVE-2023-30529 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →