Convert To Pipeline Plugin 1.0 and earlier does not require POST requests for the HTTP endpoint converting a Freestyle project to Pipeline, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to create a Pipeline based on a Freestyle project. Combined with [SECURITY-2966](https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2966)/CVE-2023-28677, this can result in the execution of unsandboxed Pipeline scripts.

Affected Packages

Maven org.jenkins-ci.plugins:convert-to-pipeline

Affected versions: 0 (last affected: 1.0)

Related CVEs

CVE-2023-28676

Key Information

GHSA ID

GHSA-48g9-h7g5-8pw2

Published

April 2, 2023 9:30 PM

Last Modified

February 25, 2025 9:41 PM

CVSS Score

7.5 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.plugins:convert-to-pipeline

GitHub Reviewed

✓ Yes

Dataset

Last updated: August 25, 2025 6:33 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.