CVE-2026-57305 · Symaro Security Advisory

Description

A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL using an attacker-specified username and password.

Severity (CVSS)

Base score	5.4
Severity	Medium
Version	CVSS 3.1
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Provided by	CISA-ADP

Weaknesses

CWE-352 — CWE-352 Cross-Site Request Forgery (CSRF)

Affected products

Vendor	Product	Versions
Jenkins Project	Jenkins Assembla Plugin	0 to <=1.4

References

https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3692%20(2) (vendor-advisory)

Authoritative sources

This page is a snapshot. For the latest enrichment and updates, view the record on CVE.org or the NVD.

Generated from the official CVE List on 25 Jun 2026 10:14 UTC.