{"id":"GHSA-r52h-fjm7-93j8","summary":"BlazeMeter Jenkins plugin vulnerable to Cross-Site Request Forgery","details":"Versions of the BlazeMeter Jenkins plugin prior to 4.22 contain a flaw which results in credential enumeration.\n","aliases":["CVE-2024-3825"],"modified":"2024-04-17T17:58:33.077878Z","published":"2024-04-17T15:30:43Z","database_specific":{"cwe_ids":["CWE-352"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2024-04-17T17:35:56Z","nvd_published_at":"2024-04-17T15:15:07Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3825"},{"type":"WEB","url":"https://github.com/Blazemeter/blazemeter-jenkins-plugin/commit/11ec94f68136a0612ae1b37b5370053132cb2528"},{"type":"PACKAGE","url":"https://github.com/Blazemeter/blazemeter-jenkins-plugin"},{"type":"WEB","url":"https://portal.perforce.com/s/detail/a91PA000001STsvYAG"}],"affected":[{"package":{"name":"com.blazemeter.plugins:BlazeMeterJenkinsPlugin","ecosystem":"Maven","purl":"pkg:maven/com.blazemeter.plugins/BlazeMeterJenkinsPlugin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.22"}]}],"versions":["1.0-beta-1","1.01-beta-2","1.02-beta-3","1.04-beta-1","1.05-beta-1","1.06-beta-1","1.07-beta-1","1.08-beta-1","2.0","2.1","2.2","2.2.1","2.3","2.4","2.5","2.5.2","2.6","2.7","2.8","3.0","3.1","4.0","4.1","4.10","4.11","4.12","4.13","4.14","4.15","4.16","4.17","4.18","4.19","4.2","4.20","4.21","4.3","4.4","4.5","4.6","4.7","4.8","4.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-r52h-fjm7-93j8/GHSA-r52h-fjm7-93j8.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}]}