PT-2023-6024 · Jenkins · Jenkins Fortify Plugin+1

CVE-2023-4301 · Publicado 2023-08-21 · Atualizado 2023-08-24

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Fortify Plugin versions 22.1.38 and earlier

Description A cross-site request forgery (CSRF) vulnerability allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs, capturing credentials stored in Jenkins. The issue is related to insufficient authentication checks for executed requests. Attackers with Overall/Read permission can exploit this vulnerability, and the affected HTTP endpoints do not require POST requests, making them vulnerable to CSRF attacks.

Recommendations For Jenkins Fortify Plugin versions 22.1.38 and earlier, update to version 22.2.39 or later, which requires POST requests and the appropriate permissions for the affected HTTP endpoints. As a temporary workaround, consider restricting access to the affected HTTP endpoints to minimize the risk of exploitation.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

BDU:2023-06725

CVE-2023-4301

GHSA-3FJV-8R82-6XM9

Produtos afetados

Jenkins

Jenkins Fortify Plugin

Referências · 10

• https://github.com/jenkinsci/fortify-plugin/commit/357d7bfbcb0ff796ea7d078bee13159f1d000f5d · Nota
• https://github.com/jenkinsci/fortify-plugin · Nota
• https://bdu.fstec.ru/vul/2023-06725 · Nota de Segurança
• https://jenkins.io/security/advisory/2023-08-16/#SECURITY-3115 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-4301 · Nota de Segurança
• https://t.me/cvenotify/57230 · Publicação no Telegram
• https://t.me/cvenotify/57036 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-4301 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-3fjv-8r82-6xm9 · Aviso do Fabricante
• https://t.me/cvenotify/57048 · Publicação no Telegram