PT-2023-19588 · Jenkins · Jenkins Bitbucket Oauth Plugin+1

Wadeck Follonier · Publicado 2023-01-24 · Atualizado 2023-02-04 · CVE-2023-24428

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Bitbucket OAuth Plugin versions 0.12 and earlier

Description A cross-site request forgery (CSRF) issue allows attackers to trick users into logging in to the attacker's account. This can be achieved by exploiting the vulnerability in the Jenkins Bitbucket OAuth Plugin, which enables attackers to perform unauthorized actions on behalf of the user.

Recommendations For Jenkins Bitbucket OAuth Plugin versions 0.12 and earlier, consider disabling the OAuth functionality until a patch is available to prevent exploitation of the CSRF vulnerability. Restrict access to sensitive operations that rely on the OAuth plugin to minimize the risk of unauthorized access.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-24428

GHSA-685J-36QX-3VP2

Produtos afetados

Jenkins

Jenkins Bitbucket Oauth Plugin

Referências · 7

• https://github.com/jenkinsci/bitbucket-oauth-plugin · Nota
• https://github.com/jenkinsci/bitbucket-oauth-plugin/commit/a927a8ff2e069afebb97f33f6798033ef4451e4f · Nota
• https://jenkins.io/security/advisory/2023-01-24/#SECURITY-2981 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-24428 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-24428 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-685j-36qx-3vp2 · Aviso do Fabricante
• https://t.me/cvenotify/43642 · Publicação no Telegram