A cross-site request forgery vulnerability in Jenkins iceScrum Plugin prior to version 1.1.6 allows attackers to connect to an attacker-specified URL using attacker-specified credentials. This issue is patched in version 1.1.6

Affected Packages

Maven org.jenkins-ci.plugins:icescrum

Affected versions: 0 (fixed in 1.1.6)

Related CVEs

CVE-2019-10441

Key Information

GHSA ID

GHSA-rxvx-9wg5-qpww

Published

May 24, 2022 4:58 PM

Last Modified

December 6, 2022 9:51 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.plugins:icescrum

GitHub Reviewed

✓ Yes

Dataset

Last updated: July 6, 2025 6:30 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.