CVE-2023-39156: 
Java vulnerability analysis and mitigation

A cross-site request forgery (CSRF) vulnerability was discovered in Jenkins Bazaar Plugin versions 1.22 and earlier. The vulnerability was identified and assigned CVE-2023-39156, with disclosure on July 26, 2023. The affected component is the Jenkins Bazaar Plugin, which is used for source code management integration (Jenkins Advisory, NVD).

The vulnerability stems from an HTTP endpoint in the Bazaar Plugin that does not require POST requests, leading to a cross-site request forgery vulnerability. The severity is rated as Medium according to CVSS v3.1, with a base score of 5.3 and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (Jenkins Advisory, NVD).

The vulnerability allows attackers to delete previously created Bazaar SCM tags through cross-site request forgery attacks (Jenkins Advisory).

The vulnerability can be exploited remotely by an attacker without requiring authentication or user interaction. The attack complexity is considered low, making it relatively straightforward to exploit (NVD).

As of the publication of the advisory, no fixes are available for the Bazaar Plugin. Users should monitor for updates and implement general CSRF protection measures (Jenkins Advisory).

The vulnerability was discovered and reported by Kevin Guerroudj from CloudBees, Inc. The Jenkins project publicly acknowledged this contribution in their security advisory (Jenkins Advisory).