A cross‑site request forgery flaw in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows an attacker to trigger a background request to an attacker‑specified URL using attacker‑supplied credential identifiers that were obtained through another route, thereby causing Jenkins to send stored credentials to that URL and capture them. The flaw is a CWE‑352 Cross‑Site Request Forgery.

Jenkins Zowe zDevOps Plugin, versions 1.1.3.50.ve350c9b_450b_1 and all earlier releases are affected; the vulnerability arises in the plugin's handling of credential identifiers and outbound requests.

The attack vector is a web‑based CSRF request; the attacker must first obtain valid credential IDs via another route and then trigger the plugin to use them in a forged request. The CVSS score of 4.2 indicates a moderate severity; EPSS is not available and the vulnerability is not listed in KEV. The vulnerability can be exploited remotely by a malicious actor with access to the Jenkins instance or who can induce a user to submit a mischievous request.