PT-2023-31284 · Jenkins · Jenkins Neuvector Vulnerability Scanner Plugin+1

Yaroslav Afenkin · Publicado 2023-11-29 · Atualizado 2023-12-05 · CVE-2023-49674

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins NeuVector Vulnerability Scanner Plugin versions 1.22 and earlier

Description A missing permission check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password. The connection test HTTP endpoint is vulnerable, and it does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Recommendations For Jenkins NeuVector Vulnerability Scanner Plugin versions 1.22 and earlier, consider upgrading to version 2.2 or later, which requires POST requests and Overall/Administer permission for the affected HTTP endpoint. As a temporary workaround, restrict access to the connection test HTTP endpoint to minimize the risk of exploitation. Avoid using the username and password variables in the affected endpoint until the issue is resolved.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2023-49674

GHSA-PH87-4X2G-6HP4

Produtos afetados

Jenkins

Jenkins Neuvector Vulnerability Scanner Plugin

Referências · 7

• https://github.com/jenkinsci/neuvector-vulnerability-scanner-plugin · Nota
• https://osv.dev/vulnerability/GHSA-ph87-4x2g-6hp4 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-49674 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2023-11-29/#SECURITY-3256 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2023/11/29/1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-49674 · Nota de Segurança
• https://t.me/cvenotify/62302 · Publicação no Telegram