A cross-site request forgery (CSRF) vulnerability in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Affected Packages

Maven io.jenkins.plugins:macstadium-orka

Affected versions: 0 (fixed in 1.32)

Related CVEs

CVE-2023-24432

Key Information

GHSA ID

GHSA-9jwh-qvg7-gr59

Published

January 26, 2023 9:30 PM

Last Modified

October 27, 2023 11:49 PM

CVSS Score

7.5 /10

Primary Ecosystem

Maven

Primary Package

io.jenkins.plugins:macstadium-orka

GitHub Reviewed

✓ Yes

Dataset

Last updated: July 5, 2025 6:26 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.