PT-2019-14714 · Jenkins · Jenkins Websphere Deployer Plugin+1

Daniel Beck · Published 2019-12-17 · Updated 2023-10-25 · CVE-2019-16559

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins WebSphere Deployer Plugin versions 1.6.1 and earlier

Description A missing permission check in the plugin allows attackers with Overall/Read permission to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system. The plugin also does not perform permission checks in methods performing form validation, allowing users with Overall/Read access to obtain limited information about the Jenkins and plugin configuration. Furthermore, the form validation methods are vulnerable to CSRF attacks as they do not require POST requests.

Recommendations For Jenkins WebSphere Deployer Plugin versions 1.6.1 and earlier, as a temporary workaround, consider restricting access to the plugin's form validation methods to minimize the risk of exploitation. Additionally, restrict the ability to perform connection tests and set plugin configuration options to authorized users only. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2019-16559

GHSA-MXF8-GRM7-MVQW

Affected Products

Jenkins

Jenkins Websphere Deployer Plugin

References · 5

• https://osv.dev/vulnerability/GHSA-mxf8-grm7-mvqw · Vendor Advisory
• https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1371 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16559 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16559 · Vendor Advisory
• http://openwall.com/lists/oss-security/2019/12/17/1 · Note