PT-2023-6008 · Jenkins · Jenkins Fortify Plugin+1
Publicado
2023-08-21
·
Atualizado
2023-08-24
·
CVE-2023-4302
CVSS v3.1
4.2
Média
| Vetor | AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Jenkins Fortify Plugin versions 22.1.38 and earlier
Description
A missing permission check in the Jenkins Fortify Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. The plugin does not perform permission checks in several HTTP endpoints, resulting in a cross-site request forgery (CSRF) vulnerability. These endpoints do not require POST requests, making them vulnerable to exploitation.
Recommendations
For Jenkins Fortify Plugin versions 22.1.38 and earlier, update to version 22.2.39 or later, which requires POST requests and the appropriate permissions for the affected HTTP endpoints. As a temporary workaround, consider restricting access to the affected HTTP endpoints to minimize the risk of exploitation. Additionally, ensure that only authorized users have Overall/Read permission to prevent potential attacks.
Correção
Missing Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Jenkins
Jenkins Fortify Plugin