PT-2019-11765 · Jenkins · Jenkins Jclouds Plugin+1

Oleg Nenashev + 1 · Published 2019-08-07 · Updated 2023-10-25 · CVE-2019-10369

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins JClouds Plugin versions 2.14 and earlier

Description A missing permission check in the Jenkins JClouds Plugin allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs, capturing credentials stored in Jenkins. The form validation method did not require POST requests, resulting in a cross-site request forgery vulnerability.

Recommendations For Jenkins JClouds Plugin versions 2.14 and earlier, update the plugin to a version that requires POST requests and Overall/Administer permission for the form validation method. As a temporary workaround, consider restricting access to the BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.DescriptorImpl#doTestConnection methods to users with Overall/Administer permission until a patch is available. Restrict access to the form validation method to minimize the risk of cross-site request forgery exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2019-10369

GHSA-7WXC-7QRG-RG6W

Affected Products

Jenkins

Jenkins Jclouds Plugin

References · 11

• https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1482 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10369 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10369 · Security Note
• https://osv.dev/vulnerability/GHSA-7wxc-7qrg-rg6w · Vendor Advisory
• https://lists.apache.org/thread.html/r725e55670dbdd214f3cfdfea255b72a75fa9a4f0c6c9d109b29c7881@%3Cnotifications.jclouds.apache.org%3E · Note
• https://lists.apache.org/thread.html/r6c4693d03d15391814c647742db49a4d9937fa34573fb66103d57b45@%3Cnotifications.jclouds.apache.org%3E · Note
• https://lists.apache.org/thread.html/r42b7ff290ed5ec8f27f12c54fff54462ffc4bcf6a5015c37fece94ac%40%3Cnotifications.jclouds.apache.org%3E · Note
• https://lists.apache.org/thread.html/r6c4693d03d15391814c647742db49a4d9937fa34573fb66103d57b45%40%3Cnotifications.jclouds.apache.org%3E · Note
• https://lists.apache.org/thread.html/r42b7ff290ed5ec8f27f12c54fff54462ffc4bcf6a5015c37fece94ac@%3Cnotifications.jclouds.apache.org%3E · Note
• http://openwall.com/lists/oss-security/2019/08/07/1 · Note
• https://lists.apache.org/thread.html/r725e55670dbdd214f3cfdfea255b72a75fa9a4f0c6c9d109b29c7881%40%3Cnotifications.jclouds.apache.org%3E · Note