PT-2019-8729 · Jenkins · Jenkins Hipchat Plugin

Viktor Gazdag · Published 2019-01-09 · Updated 2022-05-13 · CVE-2018-1000418

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins HipChat Plugin versions 2.2.0 and earlier

Description An improper authorization issue exists in the Jenkins HipChat Plugin, specifically in HipChatNotifier.java, allowing attackers with Overall/Read access to send test notifications to a specified HipChat server using attacker-specified credentials IDs. This could potentially capture credentials stored in Jenkins.

Recommendations For Jenkins HipChat Plugin versions 2.2.0 and earlier, update to version 2.2.1 or later, which requires POST requests and Overall/Administer permissions for the form validation method, thereby mitigating the issue.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2018-1000418

GHSA-W3F7-2QFW-348X

Affected Products

Jenkins Hipchat Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-1000418 · Security Note
• https://osv.dev/vulnerability/GHSA-w3f7-2qfw-348x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1000418 · Vendor Advisory
• https://jenkins.io/security/advisory/2018-09-25/#SECURITY-984%20%281%29 · Note
• https://jenkins.io/security/advisory/2018-09-25/#SECURITY-984%20(1) · Note
• http://securityfocus.com/bid/106532 · Note