PT-2023-6008 · Jenkins · Jenkins Fortify Plugin+1
Published
2023-08-21
·
Updated
2023-08-24
·
CVE-2023-4302
CVSS v3.1
4.2
Medium
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Jenkins Fortify Plugin versions 22.1.38 and earlier
Description
A missing permission check in the Jenkins Fortify Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. The plugin does not perform permission checks in several HTTP endpoints, resulting in a cross-site request forgery (CSRF) vulnerability. These endpoints do not require POST requests, making them vulnerable to exploitation.
Recommendations
For Jenkins Fortify Plugin versions 22.1.38 and earlier, update to version 22.2.39 or later, which requires POST requests and the appropriate permissions for the affected HTTP endpoints. As a temporary workaround, consider restricting access to the affected HTTP endpoints to minimize the risk of exploitation. Additionally, ensure that only authorized users have Overall/Read permission to prevent potential attacks.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jenkins
Jenkins Fortify Plugin