A cross-site request forgery (CSRF) vulnerability in Jenkins Build-Publisher Plugin 1.22 and earlier allows attackers to replace any config.xml
file on the Jenkins controller file system with an empty file by providing a crafted file name to an API endpoint. There is currently no workaround or patch as this plugin has been suspended.
{ "nvd_published_at": "2022-09-21T16:15:00Z", "github_reviewed_at": "2022-12-06T15:43:14Z", "severity": "HIGH", "github_reviewed": true, "cwe_ids": [ "CWE-352" ] }