PT-2023-31284 · Jenkins · Jenkins Neuvector Vulnerability Scanner Plugin+1

Yaroslav Afenkin · Published 2023-11-29 · Updated 2023-12-05 · CVE-2023-49674

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins NeuVector Vulnerability Scanner Plugin versions 1.22 and earlier

Description A missing permission check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password. The connection test HTTP endpoint is vulnerable, and it does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Recommendations For Jenkins NeuVector Vulnerability Scanner Plugin versions 1.22 and earlier, consider upgrading to version 2.2 or later, which requires POST requests and Overall/Administer permission for the affected HTTP endpoint. As a temporary workaround, restrict access to the connection test HTTP endpoint to minimize the risk of exploitation. Avoid using the username and password variables in the affected endpoint until the issue is resolved.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-49674

GHSA-PH87-4X2G-6HP4

Affected Products

Jenkins

Jenkins Neuvector Vulnerability Scanner Plugin

References · 7

• https://osv.dev/vulnerability/GHSA-ph87-4x2g-6hp4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-49674 · Vendor Advisory
• https://jenkins.io/security/advisory/2023-11-29/#SECURITY-3256 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49674 · Security Note
• https://github.com/jenkinsci/neuvector-vulnerability-scanner-plugin · Note
• http://openwall.com/lists/oss-security/2023/11/29/1 · Note
• https://t.me/cvenotify/62302 · Telegram Post