Jenkins Shelve Project Plugin 3.0 and earlier does not require POST requests for HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities.
These vulnerabilities allow attackers to shelve, unshelve, or delete a project.
Jenkins Shelve Project Plugin 3.1 requires POST requests for the affected HTTP endpoints.
{ "nvd_published_at": "2020-12-03T16:15:00Z", "cwe_ids": [ "CWE-352" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2022-12-16T22:26:38Z" }