CVE-2024-28158: 
Java vulnerability analysis and mitigation

A cross-site request forgery (CSRF) vulnerability has been identified in Jenkins Subversion Partial Release Manager Plugin version 1.0.1 and earlier. The vulnerability was discovered and disclosed on March 6, 2024, affecting the Jenkins plugin's HTTP endpoint functionality (Jenkins Advisory, NVD).

The vulnerability stems from the plugin's failure to require POST requests in an HTTP endpoint. The issue has been assigned a CVSS v3.1 Base Score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The vulnerability is tracked as SECURITY-3325 in Jenkins security advisory system (CISA ADP).

The vulnerability allows attackers to trigger a build in the Jenkins environment without proper authorization. This could potentially lead to unauthorized build executions and resource manipulation within the Jenkins infrastructure (Jenkins Advisory).

The vulnerability can be exploited by attackers with Item/Read permission to the Jenkins system. The attack vector involves sending unauthorized requests to the affected HTTP endpoint, which does not properly validate the request method (Jenkins Advisory).

As of the advisory publication date, there is no fix available for this vulnerability in the Subversion Partial Release Manager Plugin. Users are advised to monitor for updates and implement additional access controls where possible (Jenkins Advisory).

The vulnerability was reported by Wadeck Follonier from CloudBees, Inc., and was publicly disclosed through the Jenkins security advisory system (Jenkins Advisory).