GHSA-7jrr-fwhw-762v

GitHub Security Advisory

Jenkins Sumologic Publisher Plugin vulnerable to cross-site request forgery

✓ GitHub Reviewed HIGH Has CVE

Jenkins Sumologic Publisher Plugin 2.2.1 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Maven org.jenkins-ci.plugins:sumologic-publisher

Affected versions: 0 (last affected: 2.2.1)

CVE-2023-37958

GHSA ID

GHSA-7jrr-fwhw-762v

Published

July 12, 2023 6:30 PM

Last Modified

July 20, 2023 2:29 PM

CVSS Score

7.5 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.plugins:sumologic-publisher

GitHub Reviewed

✓ Yes

Last updated: August 24, 2025 6:28 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.