PT-2023-27399 · Jenkins · Jenkins Blue Ocean Plugin+1

Alvaro Muñoz + 1 · Published 2023-08-16 · Updated 2023-08-18 · CVE-2023-40341

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Blue Ocean Plugin versions 1.27.5 and earlier

Description A cross-site request forgery (CSRF) vulnerability allows attackers to connect to an attacker-specified URL, capturing GitHub credentials associated with an attacker-specified job. This issue is due to an incomplete fix and results from not requiring POST requests for an HTTP endpoint. The vulnerability enables attackers to exploit the HTTP endpoint and capture sensitive information.

Recommendations For Jenkins Blue Ocean Plugin versions 1.27.5 and earlier, update to a version that includes the complete fix for the issue, such as version 1.27.5.1, which uses the configured SCM URL instead of a user-specified URL. As a temporary workaround, consider restricting access to the vulnerable HTTP endpoint until a patch is applied.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-40341

GHSA-G4PQ-P927-7PGG

RHSA-2024:0777

RHSA-2024:0778

Affected Products

Jenkins

Jenkins Blue Ocean Plugin

References · 10

• https://jenkins.io/security/advisory/2023-08-16/#SECURITY-3116 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g4pq-p927-7pgg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40341 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40341 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1691855733027995655 · Twitter Post
• https://twitter.com/CVEnew/status/1691822019304661116 · Twitter Post
• https://t.me/cvenotify/56886 · Telegram Post
• https://t.me/cvenotify/56802 · Telegram Post
• https://t.me/cvenotify/56608 · Telegram Post
• http://openwall.com/lists/oss-security/2023/08/16/3 · Note