PT-2023-26211 · Jenkins · Jenkins Benchmark Evaluator Plugin+1
Alvaro Muñoz
+1
·
Publicado
2023-07-12
·
Atualizado
2023-07-20
·
CVE-2023-37962
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Jenkins Benchmark Evaluator Plugin versions 1.0.1 and earlier
Description
A cross-site request forgery (CSRF) vulnerability allows attackers to connect to an attacker-specified URL and to check for the existence of directories,
.csv, and .ycsb files on the Jenkins controller file system. This issue arises because the plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to exploit this vulnerability. Furthermore, the form validation method does not require POST requests, contributing to the CSRF vulnerability.Recommendations
For Jenkins Benchmark Evaluator Plugin versions 1.0.1 and earlier, consider disabling the form validation method temporarily until a patch is available to prevent exploitation. Restrict access to the plugin's functionality to minimize the risk of attackers connecting to attacker-specified URLs and checking for file existence on the Jenkins controller file system. Avoid using the plugin's features that do not require POST requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
CSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Jenkins
Jenkins Benchmark Evaluator Plugin