PT-2019-11764 · Jenkins · Jenkins Jclouds Plugin+1

Xingyunyang · Published 2019-08-07 · Updated 2023-10-25 · CVE-2019-10368

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jenkins JClouds Plugin versions 2.14 and earlier

Description A cross-site request forgery issue allows users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs, potentially capturing credentials stored in Jenkins. The vulnerability is due to a lack of permission checks on a form validation method, which also did not require POST requests.

Recommendations For Jenkins JClouds Plugin versions 2.14 and earlier, update the plugin to a version that requires POST requests and Overall/Administer permission for the form validation method, thus preventing the cross-site request forgery vulnerability.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-10368

GHSA-87HX-Q65G-R35X

Affected Products

Jenkins

Jenkins Jclouds Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2019-10368 · Security Note
• https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1482 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10368 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-87hx-q65g-r35x · Vendor Advisory
• https://lists.apache.org/thread.html/r42b7ff290ed5ec8f27f12c54fff54462ffc4bcf6a5015c37fece94ac%40%3Cnotifications.jclouds.apache.org%3E · Note
• https://lists.apache.org/thread.html/r6c4693d03d15391814c647742db49a4d9937fa34573fb66103d57b45%40%3Cnotifications.jclouds.apache.org%3E · Note
• http://openwall.com/lists/oss-security/2019/08/07/1 · Note
• https://lists.apache.org/thread.html/r725e55670dbdd214f3cfdfea255b72a75fa9a4f0c6c9d109b29c7881%40%3Cnotifications.jclouds.apache.org%3E · Note