PT-2023-26203 · Jenkins · Jenkins Test Results Aggregator Plugin+1

Alvaro Muñoz + 1 · Published 2023-07-12 · Updated 2023-07-20 · CVE-2023-37955

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Test Results Aggregator Plugin versions 1.2.13 and earlier

Description A cross-site request forgery (CSRF) vulnerability allows attackers to connect to an attacker-specified URL using attacker-specified credentials. This issue arises because the plugin does not perform a permission check in an HTTP endpoint implementing form validation, allowing attackers with Overall/Read permission to exploit this vulnerability. The HTTP endpoint is also vulnerable because it does not require POST requests.

Recommendations For Jenkins Test Results Aggregator Plugin versions 1.2.13 and earlier, consider disabling the HTTP endpoint implementing form validation until a patch is available to prevent exploitation. Restrict access to the plugin's form validation functionality to minimize the risk of CSRF attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-37955

GHSA-8GC7-WHPH-RX5Q

Affected Products

Jenkins

Jenkins Test Results Aggregator Plugin

References · 7

• https://jenkins.io/security/advisory/2023-07-12/#SECURITY-3122 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8gc7-whph-rx5q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37955 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37955 · Vendor Advisory
• https://github.com/jenkinsci/test-results-aggregator-plugin/commit/7dc29066d70af52cb3aa143783e8d2cb863fa4f7 · Note
• http://openwall.com/lists/oss-security/2023/07/12/2 · Note
• https://t.me/cibsecurity/66570 · Telegram Post