PT-2018-9325 · Jenkins · Jenkins Vsphere Plugin+1

Daniel Beck · Published 2018-04-05 · Updated 2022-05-14 · CVE-2018-1000153

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins vSphere Plugin versions 2.16 and older

Description A cross-site request forgery issue exists in the Jenkins vSphere Plugin that allows attackers to perform form validation related actions. This includes sending numerous requests to the configured vSphere server, potentially resulting in denial of service, or sending credentials stored in Jenkins with a known ID to an attacker-specified server, specifically through the "test connection" feature. The form validation methods in the affected versions did not require POST requests, contributing to the CSRF vulnerability.

Recommendations For Jenkins vSphere Plugin versions 2.16 and older, update to version 2.17 or later, which requires POST requests and appropriate user permissions for form validation methods, thereby mitigating the CSRF vulnerability.

Fix

DoS

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-1000153

GHSA-2G32-2J8W-2QGF

Affected Products

Jenkins

Jenkins Vsphere Plugin

References · 5

• https://osv.dev/vulnerability/GHSA-2g32-2j8w-2qgf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000153 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1000153 · Vendor Advisory
• https://jenkins.io/security/advisory/2018-03-26/#SECURITY-745 · Vendor Advisory
• https://github.com/jenkinsci/vsphere-cloud-plugin · Note