PT-2019-8723 · Jenkins · Jenkins Jira Plugin+1

Wadeck Follonier · Published 2019-01-09 · Updated 2022-05-13 · CVE-2018-1000412

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Jira Plugin versions 3.0.1 and earlier

Description An improper authorization issue exists in the JiraSite.java component, allowing attackers with Overall/Read access to connect Jenkins to an attacker-specified URL using attacker-specified credentials IDs. This could lead to the capture of credentials stored in Jenkins.

Recommendations For Jenkins Jira Plugin versions 3.0.1 and earlier, consider updating to version 3.0.2 or later, which requires POST requests and stricter permissions, such as Overall/Administer for globally defined sites or Item/Configure for sites defined for a folder, to mitigate the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2018-1000412

GHSA-FPG6-XQJ4-J7WF

Affected Products

Jenkins

Jenkins Jira Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-1000412 · Security Note
• https://osv.dev/vulnerability/GHSA-fpg6-xqj4-j7wf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1000412 · Vendor Advisory
• https://github.com/jenkinsci/jira-plugin/commit/612a6ef06dbd5a63bea0b128142c726e96195eda · Note
• https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1029 · Note
• http://securityfocus.com/bid/106532 · Note