CVS Plugin 2.15 and earlier does not require POST requests in several HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities. This allows attackers to create and manipulate tags, and to connect to an attacker-specified URL.

CVS Plugin 2.16 now requires POST requests for the affected HTTP endpoints.

Affected Packages

Maven org.jenkins-ci.plugins:cvs

Affected versions: 0 (fixed in 2.16)

Related CVEs

CVE-2020-2184

Key Information

GHSA ID

GHSA-63mw-hp3h-gc77

Published

May 24, 2022 5:17 PM

Last Modified

December 16, 2022 10:56 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.plugins:cvs

GitHub Reviewed

✓ Yes

Dataset

Last updated: July 4, 2025 6:27 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.