PT-2022-22331 · Xebialabs+1 · Jenkins Xebialabs Xl Release Plugin+1

Wadeck Follonier · Published 2022-06-30 · Updated 2023-11-03 · CVE-2022-34780

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins XebiaLabs XL Release Plugin versions 22.0.0 and earlier

Description A cross-site request forgery (CSRF) vulnerability allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. The vulnerability is due to the lack of permission checks in methods implementing form validation, which can be exploited by attackers with Overall/Read permission. Additionally, the form validation methods do not require POST requests, further facilitating the CSRF vulnerability.

Recommendations For Jenkins XebiaLabs XL Release Plugin versions 22.0.0 and earlier, update to version 22.0.1 or later, which requires POST requests and Overall/Administer permission for the affected form validation methods. As a temporary workaround, consider restricting access to the form validation methods to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-34780

GHSA-H7PF-H58R-MV93

Affected Products

Jenkins

Jenkins Xebialabs Xl Release Plugin

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2022-34780 · Security Note
• https://jenkins.io/security/advisory/2022-06-30/#SECURITY-2773%20%282%29 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-34780 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h7pf-h58r-mv93 · Vendor Advisory
• https://github.com/jenkinsci/xlrelease-plugin · Note
• https://t.me/cibsecurity/45441 · Telegram Post
• https://t.me/cvenotify/32803 · Telegram Post
• https://jenkins.io/security/advisory/2022-06-30/#SECURITY-2773%20(2) · Note
• https://t.me/cvenotify/60492 · Telegram Post