PT-2019-11712 · Jenkins · Jenkins Ansible Tower Plugin+1

Peter Adkins · Published 2019-04-30 · Updated 2023-10-25 · CVE-2019-10310

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jenkins Ansible Tower Plugin version 0.9.1 and earlier

Description A cross-site request forgery issue allowed attackers to connect to a specified URL using specified credentials IDs, potentially capturing stored credentials in Jenkins. The vulnerability arose from a lack of permission checks on a form validation method, enabling users with Overall/Read access to exploit it. The method also did not require POST requests, further contributing to the vulnerability.

Recommendations For Jenkins Ansible Tower Plugin version 0.9.1 and earlier, update the plugin to a version that requires POST requests and Overall/Administer permissions for the form validation method, such as the version that includes the fix for this issue. As a temporary workaround, consider restricting access to the TowerInstallation.TowerInstallationDescriptor#doTestTowerConnection form validation method to users with Overall/Administer permissions until a patch is applied.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-10310

GHSA-VRVM-459Q-J824

Affected Products

Jenkins

Jenkins Ansible Tower Plugin

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2019-10310 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10310 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vrvm-459q-j824 · Vendor Advisory
• https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1355 · Vendor Advisory
• http://openwall.com/lists/oss-security/2019/04/30/5 · Note
• https://web.archive.org/web/20200227073756/http://securityfocus.com/bid/108159 · Note
• http://securityfocus.com/bid/108159 · Note
• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0786 · Note
• https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1355%20(1) · Note