PT-2019-8728 · Jenkins · Jenkins Email Extension Template Plugin+1

Daniel Beck · Publicado 2019-01-09 · Atualizado 2022-05-14 · CVE-2018-1000417

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Email Extension Template Plugin version 1.0 and earlier

Description A cross-site request forgery issue exists in the ExtEmailTemplateManagement.java file, allowing unauthorized creation or removal of templates.

Recommendations For Jenkins Email Extension Template Plugin version 1.0 and earlier, consider disabling the ExtEmailTemplateManagement.java functionality until a patch is available to prevent unauthorized template creation or removal.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2018-1000417

GHSA-4M38-GQH8-X266

Produtos afetados

Jenkins

Jenkins Email Extension Template Plugin

Referências · 6

• https://github.com/jenkinsci/emailext-template-plugin/commit/74653060cef7507425642841e0f2e58d10aa389f · Nota
• http://securityfocus.com/bid/106532 · Nota
• https://osv.dev/vulnerability/CVE-2018-1000417 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-4m38-gqh8-x266 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000417 · Nota de Segurança
• https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1125 · Nota