PT-2023-28848 · Jenkins · Jenkins Build Failure Analyzer Plugin+1

Andrea Chiera · Publicado 2023-09-20 · Atualizado 2023-09-27 · CVE-2023-43502

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Build Failure Analyzer Plugin versions 2.4.1 and earlier

Description A cross-site request forgery (CSRF) vulnerability allows attackers to delete Failure Causes. This issue arises because the plugin does not require POST requests for a specific HTTP endpoint, making it vulnerable to CSRF attacks.

Recommendations For versions 2.4.1 and earlier, update to version 2.4.2 or later, which requires POST requests for the affected HTTP endpoint, thus mitigating the CSRF vulnerability.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-43502

GHSA-2WWH-QGH8-W9XW

Produtos afetados

Jenkins

Jenkins Build Failure Analyzer Plugin

Referências · 11

• https://github.com/jenkinsci/build-failure-analyzer-plugin/commit/a261229a67c52927d531c48ec0a59bf138ebd4d0 · Nota
• http://openwall.com/lists/oss-security/2023/09/20/5 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-43502 · Nota de Segurança
• https://t.me/cibsecurity/70811 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-43502 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1704530927932805407 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1704570172902674682 · Publicação no Twitter
• https://jenkins.io/security/advisory/2023-09-20/#SECURITY-3239 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-2wwh-qgh8-w9xw · Aviso do Fabricante
• https://t.me/cvenotify/58183 · Publicação no Telegram
• https://twitter.com/fletch_ai/status/1706958623815918029 · Publicação no Twitter