PT-2018-15217 · Jenkins · Jenkins Publisher Over Cifs Plugin+1

Viktor Gazdag · Publicado 2018-08-01 · Atualizado 2022-05-14 · CVE-2018-1999038

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Publisher Over CIFS Plugin versions 0.10 and earlier

Description A confused deputy issue exists that allows attackers to have Jenkins connect to an attacker-specified CIFS server with attacker-specified credentials. Additionally, a CSRF issue is present due to a form validation method not requiring POST requests.

Recommendations For Jenkins Publisher Over CIFS Plugin versions 0.10 and earlier, update to version 0.11 or later, which requires POST requests and Overall/Administer permissions for the form validation method, addressing both the confused deputy and CSRF issues.

Correção

Enumeração de Fraquezas

CWE-441

Identificadores relacionados

CVE-2018-1999038

GHSA-RF7H-9M85-535V

Produtos afetados

Jenkins

Jenkins Publisher Over Cifs Plugin

Referências · 6

• https://github.com/jenkinsci/publish-over-cifs-plugin/commit/9402d8c1044508c2fc30a5dd1e34afe6819616a0 · Nota
• https://github.com/jenkinsci/publish-over-cifs-plugin · Nota
• https://jenkins.io/security/advisory/2018-07-30/#SECURITY-975 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999038 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-1999038 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-rf7h-9m85-535v · Aviso do Fabricante