{"schema":"threatline.record/2","record":{"id":"CVE-2026-57298","aliases":["GHSA-6qc4-57v3-28rr"],"summary":"Jenkins Contrast Continuous Application Security Plugin has a CSRF vulnerability","details":"Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier does not perform a permission check in an HTTP endpoint that tests the connection to a Contrast TeamServer.\n\nThis allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username, API key, and service key.\n\nAdditionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.\n\nContrast Continuous Application Security Plugin 3.12 requires Overall/Administer permission and POST requests to test the connection to a Contrast TeamServer.","categories":["Applications & CMS"],"product":"org.jenkins-ci.plugins:contrast-continuous-application-security","vendor":"Jenkins Project","ecosystem":"maven","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-6qc4-57v3-28rr","source_modified_at":"2026-09-25T19:13:06Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.jenkins-ci.plugins:contrast-continuous-application-security"},"range":"< 3.12"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-57298","source_modified_at":"2026-06-24T15:12:29.222Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Jenkins Contrast Continuous Application Security Plugin","vendor":"Jenkins Project","versions":[{"version":"0","versionType":"maven","lessThanOrEqual":"3.11","status":"affected"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-6qc4-57v3-28rr","source_modified_at":"2026-09-25T19:30:10.033201790Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.jenkins-ci.plugins:contrast-continuous-application-security","purl":"pkg:maven/org.jenkins-ci.plugins/contrast-continuous-application-security"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"3.12"}],"type":"ECOSYSTEM"}],"versions":["1.0","1.1","1.2","1.3","1.4","1.6","2.0","2.1","2.10","2.10-beta","2.10-beta2","2.11","2.12","2.12.1","2.2","2.3","2.4","2.5","2.6","2.7","2.8","2.8-beta","2.9","3.0","3.0.1","3.1","3.1.1","3.10","3.11","3.2","3.3","3.4","3.5","3.6","3.7","3.8.1","3.8.2","3.8.3","3.9"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-6qc4-57v3-28rr","source_modified_at":"2026-09-25T19:13:06Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.jenkins-ci.plugins:contrast-continuous-application-security"},"version":"3.12"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-6qc4-57v3-28rr","source_modified_at":"2026-09-25T19:30:10.033201790Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.jenkins-ci.plugins:contrast-continuous-application-security","purl":"pkg:maven/org.jenkins-ci.plugins/contrast-continuous-application-security"},"version":"3.12"}],"cvss":5.4,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00136,"percentile":0.02767,"score_date":"2026-10-23"},"published_at":"2026-06-24T13:20:14.518Z","modified_at":"2026-09-25T19:30:10.033201790Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-6qc4-57v3-28rr","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-25T19:13:06Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-57298","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-06-24T15:12:29.222Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-6qc4-57v3-28rr","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-25T19:30:10.033201790Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57298","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57298","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3697%20(1)","tags":["vendor-advisory"]},{"url":"https://github.com/jenkinsci/contrast-continuous-application-security-plugin/commit/ddea0a815aec52c0695d8c0c7f09f9cfce4989e5","source":"GitHub Advisory Database"},{"url":"https://github.com/jenkinsci/contrast-continuous-application-security-plugin/releases/tag/contrast-continuous-application-security-3.12","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-6qc4-57v3-28rr","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-06-24T15:09:15.997522Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-25T19:30:10.033201790Z","content_hash":"8c135652dc678a10b68f47f3b2dfd51bd99a649abf7542d5a8b65d042ec8053d"}}