PT-2023-26203 · Jenkins · Jenkins Test Results Aggregator Plugin+1

Alvaro Muñoz + 1 · Publicado 2023-07-12 · Atualizado 2023-07-20 · CVE-2023-37955

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Test Results Aggregator Plugin versions 1.2.13 and earlier

Description A cross-site request forgery (CSRF) vulnerability allows attackers to connect to an attacker-specified URL using attacker-specified credentials. This issue arises because the plugin does not perform a permission check in an HTTP endpoint implementing form validation, allowing attackers with Overall/Read permission to exploit this vulnerability. The HTTP endpoint is also vulnerable because it does not require POST requests.

Recommendations For Jenkins Test Results Aggregator Plugin versions 1.2.13 and earlier, consider disabling the HTTP endpoint implementing form validation until a patch is available to prevent exploitation. Restrict access to the plugin's form validation functionality to minimize the risk of CSRF attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-37955

GHSA-8GC7-WHPH-RX5Q

Produtos afetados

Jenkins

Jenkins Test Results Aggregator Plugin

Referências · 7

• https://github.com/jenkinsci/test-results-aggregator-plugin/commit/7dc29066d70af52cb3aa143783e8d2cb863fa4f7 · Nota
• https://jenkins.io/security/advisory/2023-07-12/#SECURITY-3122 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-8gc7-whph-rx5q · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2023/07/12/2 · Nota
• https://t.me/cibsecurity/66570 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-37955 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-37955 · Aviso do Fabricante