PT-2023-31283 · Jenkins · Jenkins Neuvector Vulnerability Scanner Plugin+1

Yaroslav Afenkin · Published 2023-11-29 · Updated 2024-08-01 · CVE-2023-49673

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins NeuVector Vulnerability Scanner Plugin versions 1.22 and earlier

Description A cross-site request forgery (CSRF) vulnerability exists due to the lack of permission checks in a connection test HTTP endpoint, allowing attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password. This endpoint also does not require POST requests, further contributing to the vulnerability.

Recommendations For Jenkins NeuVector Vulnerability Scanner Plugin versions 1.22 and earlier, consider updating to version 2.2 or later, which requires POST requests and Overall/Administer permission for the affected HTTP endpoint, thus mitigating the issue. As a temporary workaround, restrict access to the connection test HTTP endpoint to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-49673

GHSA-WPFC-R5QQ-7R7P

Affected Products

Jenkins

Jenkins Neuvector Vulnerability Scanner Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-49673 · Security Note
• https://osv.dev/vulnerability/CVE-2023-49673 · Vendor Advisory
• https://jenkins.io/security/advisory/2023-11-29/#SECURITY-3256 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wpfc-r5qq-7r7p · Vendor Advisory
• https://github.com/jenkinsci/neuvector-vulnerability-scanner-plugin · Note
• http://openwall.com/lists/oss-security/2023/11/29/1 · Note