PT-2019-8729 · Jenkins · Jenkins Hipchat Plugin

Viktor Gazdag · Publicado 2019-01-09 · Atualizado 2022-05-13 · CVE-2018-1000418

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins HipChat Plugin versions 2.2.0 and earlier

Description An improper authorization issue exists in the Jenkins HipChat Plugin, specifically in HipChatNotifier.java, allowing attackers with Overall/Read access to send test notifications to a specified HipChat server using attacker-specified credentials IDs. This could potentially capture credentials stored in Jenkins.

Recommendations For Jenkins HipChat Plugin versions 2.2.0 and earlier, update to version 2.2.1 or later, which requires POST requests and Overall/Administer permissions for the form validation method, thereby mitigating the issue.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2018-1000418

GHSA-W3F7-2QFW-348X

Produtos afetados

Jenkins Hipchat Plugin

Referências · 6

• https://jenkins.io/security/advisory/2018-09-25/#SECURITY-984%20%281%29 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000418 · Nota de Segurança
• https://jenkins.io/security/advisory/2018-09-25/#SECURITY-984%20(1) · Nota
• https://osv.dev/vulnerability/GHSA-w3f7-2qfw-348x · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1000418 · Aviso do Fabricante
• http://securityfocus.com/bid/106532 · Nota