A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins.
Jenkins XebiaLabs XL Deploy Plugin 10.0.2 requires POST requests and Overall/Administer permission for the affected form validation method.
{ "nvd_published_at": "2021-06-10T15:15:00Z", "cwe_ids": [ "CWE-352" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2022-12-14T16:12:42Z" }