PT-2018-15217 · Jenkins · Jenkins Publisher Over Cifs Plugin+1

Viktor Gazdag · Published 2018-08-01 · Updated 2022-05-14 · CVE-2018-1999038

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Publisher Over CIFS Plugin versions 0.10 and earlier

Description A confused deputy issue exists that allows attackers to have Jenkins connect to an attacker-specified CIFS server with attacker-specified credentials. Additionally, a CSRF issue is present due to a form validation method not requiring POST requests.

Recommendations For Jenkins Publisher Over CIFS Plugin versions 0.10 and earlier, update to version 0.11 or later, which requires POST requests and Overall/Administer permissions for the form validation method, addressing both the confused deputy and CSRF issues.

Fix

Weakness Enumeration

CWE-441

Related Identifiers

CVE-2018-1999038

GHSA-RF7H-9M85-535V

Affected Products

Jenkins

Jenkins Publisher Over Cifs Plugin

References · 6

• https://jenkins.io/security/advisory/2018-07-30/#SECURITY-975 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999038 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1999038 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rf7h-9m85-535v · Vendor Advisory
• https://github.com/jenkinsci/publish-over-cifs-plugin/commit/9402d8c1044508c2fc30a5dd1e34afe6819616a0 · Note
• https://github.com/jenkinsci/publish-over-cifs-plugin · Note