PT-2018-15216 · Jenkins · Jenkins Resource Disposer Plugin+1

Viktor Gazdag · Publicado 2018-08-01 · Atualizado 2022-05-14 · CVE-2018-1999037

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Resource Disposer Plugin versions 0.11 and earlier

Description A data modification issue exists that allows attackers to stop tracking a specified resource. This is related to the AsyncResourceDisposer.java file. Additionally, a CSRF issue was identified due to an API endpoint not requiring POST requests.

Recommendations For Jenkins Resource Disposer Plugin versions 0.11 and earlier, update to version 0.12 or later, which requires POST requests and Overall/Administer permissions for the affected API endpoint.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-1999037

GHSA-63JG-5WV6-7GHV

Produtos afetados

Jenkins

Jenkins Resource Disposer Plugin

Referências · 6

• https://github.com/jenkinsci/resource-disposer-plugin · Nota
• https://github.com/jenkinsci/resource-disposer-plugin/commit/d826a99b06cc46c5dfadfd526b519ef0f65c8682 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999037 · Nota de Segurança
• https://jenkins.io/security/advisory/2018-07-30/#SECURITY-997 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1999037 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-63jg-5wv6-7ghv · Aviso do Fabricante