PT-2018-15216 · Jenkins · Jenkins Resource Disposer Plugin+1

Viktor Gazdag · Published 2018-08-01 · Updated 2022-05-14 · CVE-2018-1999037

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Resource Disposer Plugin versions 0.11 and earlier

Description A data modification issue exists that allows attackers to stop tracking a specified resource. This is related to the AsyncResourceDisposer.java file. Additionally, a CSRF issue was identified due to an API endpoint not requiring POST requests.

Recommendations For Jenkins Resource Disposer Plugin versions 0.11 and earlier, update to version 0.12 or later, which requires POST requests and Overall/Administer permissions for the affected API endpoint.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-1999037

GHSA-63JG-5WV6-7GHV

Affected Products

Jenkins

Jenkins Resource Disposer Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-1999037 · Security Note
• https://jenkins.io/security/advisory/2018-07-30/#SECURITY-997 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1999037 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-63jg-5wv6-7ghv · Vendor Advisory
• https://github.com/jenkinsci/resource-disposer-plugin · Note
• https://github.com/jenkinsci/resource-disposer-plugin/commit/d826a99b06cc46c5dfadfd526b519ef0f65c8682 · Note