A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging, MavenReleaseApiAction#doStaging, and UnifiedPromoteBuildAction#doSubmit allowed attackers to schedule a release build, perform release staging for Gradle and Maven projects, and promote previously staged builds, respectively.

Affected Packages

Maven org.jenkins-ci.plugins:artifactory

Affected versions: 0 (fixed in 3.2.3)

Related CVEs

CVE-2019-10324

Key Information

GHSA ID

GHSA-mqj3-fc39-73fj

Published

May 24, 2022 10:00 PM

Last Modified

January 30, 2024 9:24 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.plugins:artifactory

GitHub Reviewed

✓ Yes

Dataset

Last updated: August 24, 2025 6:28 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.