PT-2019-8723 · Jenkins · Jenkins Jira Plugin+1

Wadeck Follonier · Publicado 2019-01-09 · Atualizado 2022-05-13 · CVE-2018-1000412

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Jira Plugin versions 3.0.1 and earlier

Description An improper authorization issue exists in the JiraSite.java component, allowing attackers with Overall/Read access to connect Jenkins to an attacker-specified URL using attacker-specified credentials IDs. This could lead to the capture of credentials stored in Jenkins.

Recommendations For Jenkins Jira Plugin versions 3.0.1 and earlier, consider updating to version 3.0.2 or later, which requires POST requests and stricter permissions, such as Overall/Administer for globally defined sites or Item/Configure for sites defined for a folder, to mitigate the risk of exploitation.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2018-1000412

GHSA-FPG6-XQJ4-J7WF

Produtos afetados

Jenkins

Jenkins Jira Plugin

Referências · 6

• https://github.com/jenkinsci/jira-plugin/commit/612a6ef06dbd5a63bea0b128142c726e96195eda · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000412 · Nota de Segurança
• https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1029 · Nota
• https://osv.dev/vulnerability/GHSA-fpg6-xqj4-j7wf · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1000412 · Aviso do Fabricante
• http://securityfocus.com/bid/106532 · Nota