A cross‑site request forgery vulnerability in the Jenkins SCM‑Manager Plugin (versions 1.11.1 and earlier) allows an attacker to force Jenkins to connect to an arbitrary, attacker‑specified URL using credentials IDs that have been obtained through another avenue. The attacker can capture credentials that are stored in Jenkins, potentially giving them access to other parts of the system.

The vulnerability affects the Jenkins Project’s SCM‑Manager Plugin, specifically versions 1.11.1 and older. No other vendors or products are listed.

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating no current known widespread exploitation. The CVSS score of 4.2 reflects limited severity. Because the flaw is a CSRF attack, exploitation requires the attacker to convince an authenticated Jenkins user to perform a request; this is inferred from the description. Once triggered, the attacker can obtain credential IDs and use them to connect to an arbitrary URL, enabling credential theft or lateral movement. The lack of publicly available exploitation knowledge suggests the risk remains primarily limited to the potential for credential compromise if an authenticated session is available.