Executive brief
The Jenkins Assembla Plugin, which integrates Jenkins with the Assembla project management platform, contains a security flaw. This vulnerability allows an attacker to trick a user into making an unauthorized request that connects Jenkins to a server controlled by the attacker. This could lead to the exposure of sensitive credentials or unauthorized communication between systems.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Jenkins Assembla Plugin versions 1.4 and earlier. The flaw resides in an HTTP endpoint that lacks proper CSRF protection, allowing an attacker to craft a malicious request that forces the Jenkins server to initiate a connection to an arbitrary URL. This connection can include attacker-specified credentials (username and password). An attacker could exploit this by social engineering a Jenkins administrator into visiting a malicious site, potentially leading to credential disclosure or Server-Side Request Forgery (SSRF) style attacks. As of the advisory date, no patch has been specified in the provided text, though the plugin is identified as affected up to version 1.4.
Affected products
- Jenkins Project Assembla Plugin 1.4 and earlier
Timeline
- 2026-06-24: disclosed: Vulnerability published in Jenkins Security Advisory.
- 2026-06-24: advisory: NVD record published.