PT-2023-31283 · Jenkins · Jenkins Neuvector Vulnerability Scanner Plugin+1

Yaroslav Afenkin · Publicado 2023-11-29 · Atualizado 2024-08-01 · CVE-2023-49673

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins NeuVector Vulnerability Scanner Plugin versions 1.22 and earlier

Description A cross-site request forgery (CSRF) vulnerability exists due to the lack of permission checks in a connection test HTTP endpoint, allowing attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password. This endpoint also does not require POST requests, further contributing to the vulnerability.

Recommendations For Jenkins NeuVector Vulnerability Scanner Plugin versions 1.22 and earlier, consider updating to version 2.2 or later, which requires POST requests and Overall/Administer permission for the affected HTTP endpoint, thus mitigating the issue. As a temporary workaround, restrict access to the connection test HTTP endpoint to minimize the risk of exploitation.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-49673

GHSA-WPFC-R5QQ-7R7P

Produtos afetados

Jenkins

Jenkins Neuvector Vulnerability Scanner Plugin

Referências · 6

• https://github.com/jenkinsci/neuvector-vulnerability-scanner-plugin · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-49673 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-49673 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2023-11-29/#SECURITY-3256 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2023/11/29/1 · Nota
• https://osv.dev/vulnerability/GHSA-wpfc-r5qq-7r7p · Aviso do Fabricante