Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• jenkins subversionup to 2.8 inclusive

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2021-21698Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller fr
  31Monitor
• CVE-2020-2304Jenkins Subversion Plugin 2.13.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
  26Monitor
• CVE-2022-29046Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views
  22Monitor
• CVE-2020-2111Jenkins Subversion Plugin 2.13.0 and earlier does not escape the error message for the Project Repository Base URL field form validation, re
  21Monitor
• CVE-2018-1000111An improper authorization vulnerability exists in Jenkins Subversion Plugin version 2.10.2 and earlier in SubversionStatus.java and Subversi
  21Monitor
• CVE-2022-29048A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to connect to an attacker
  18Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

State-changing requests rely on the session cookie the browser sends automatically; nothing verifies that the request came from the user’s own page.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1app.use(session({ cookie: { httpOnly: true } }));2app.post("/account/address", updateAddress);

1app.use(session({ cookie: { httpOnly: true, sameSite: "lax" } }));2app.post("/account/address", csrfProtection, updateAddress);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.