{"id":"CVE-2026-48925","aliases":["EUVD-2026-32516","GHSA-rf8w-7c3g-7h3g"],"status":"published","title":"Jenkins GitHub Integration Plugin has a cross-site request forgery (CSRF) vulnerability","description":"A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows attackers to attackers to trigger a build for a pull request.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00105,"percentile":0.01057,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2026-05-27T14:13:51Z","modified":"2026-10-24T10:30:28Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:github-integration-parent","fixed_in":["0.7.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:github-integration-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.7.3"},{"fixed":"0.7.4"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:github-integration-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.4"}]}],"versions":["0.0.1-beta15","0.0.1-beta16","0.0.1-beta17","0.0.1-rc1","0.0.1-rc2","0.0.1-rc3","0.0.1-rc4","0.0.1-rc5","0.1.0-rc10","0.1.0-rc11","0.1.0-rc12","0.1.0-rc13","0.1.0-rc14","0.1.0-rc15","0.1.0-rc16","0.1.0-rc17","0.1.0-rc18","0.1.0-rc19","0.1.0-rc20","0.1.0-rc21","0.1.0-rc22","0.1.0-rc23","0.1.0-rc24","0.1.0-rc25","0.1.0-rc26","0.1.0-rc27","0.1.0-rc28","0.1.0-rc29","0.1.0-rc6","0.1.0-rc7","0.1.0-rc8","0.1.0-rc9","0.2.0","0.2.0-alpha-1","0.2.0-alpha-2","0.2.0-alpha-3","0.2.0-rc-1","0.2.0-rc-2","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.2.7","0.2.8","0.3.0","0.4.0","0.5.0","0.6.1","0.7.0","0.7.1","0.7.2","0.7.3"]}],"products":[{"vendor":"jenkins project","product":"jenkins github integration plugin"},{"vendor":"kostyasha","product":"github_integration"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3776","tags":["vendor-advisory","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48925","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rf8w-7c3g-7h3g"},{"url":"https://github.com/KostyaSha/github-integration-plugin","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-48925","description":"A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows attackers to attackers to trigger a build for a pull request.","status":"published","published":"2026-05-27T14:13:51.969Z","modified":"2026-05-27T15:22:16.078Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T13:50:38.739766Z"}],"euvd":[{"id":"EUVD-2026-32516","description":"A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows attackers to attackers to trigger a build for a pull request.","status":"published","published":"2026-05-27T14:13:51Z","modified":"2026-05-27T15:22:16Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:21:04.415835Z"}],"ghsa":[{"id":"GHSA-rf8w-7c3g-7h3g","title":"Jenkins GitHub Integration Plugin has a cross-site request forgery (CSRF) vulnerability","description":"Jenkins GitHub Integration Plugin 0.7.3 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.\n\nThis vulnerability allows attackers to trigger a build for a pull request.\n\nGitHub Integration Plugin 0.7.4 requires POST requests for the affected HTTP endpoint.","status":"published","published":"2026-05-27T15:33:27Z","modified":"2026-07-01T19:44:21Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:40:36.577366Z"}],"nvd":[{"id":"CVE-2026-48925","description":"A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows attackers to attackers to trigger a build for a pull request.","status":"published","published":"2026-05-27T15:16:32.19Z","modified":"2026-10-14T20:10:00.19Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:12:20.885865Z"}],"osv":[{"id":"CVE-2026-48925","description":"A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows attackers to attackers to trigger a build for a pull request.","status":"published","published":"2026-05-27T15:16:32.19Z","modified":"2026-10-24T10:30:28.79650762Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:07.060148Z"},{"id":"GHSA-rf8w-7c3g-7h3g","title":"Jenkins GitHub Integration Plugin has a cross-site request forgery (CSRF) vulnerability","description":"Jenkins GitHub Integration Plugin 0.7.3 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.\n\nThis vulnerability allows attackers to trigger a build for a pull request.\n\nGitHub Integration Plugin 0.7.4 requires POST requests for the affected HTTP endpoint.","status":"published","published":"2026-05-27T15:33:27Z","modified":"2026-07-01T20:11:28.843675Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:55.877614Z"}]}}