1. Home
  2. Security Advisories
  3. Jenkins
  4. JENKINS:SECURITY-1410-1

[JENKINS:SECURITY-1410-1] CSRF vulnerability and missing permission checks in `electricflow` allowed SSRF

Severity Medium
Affected Packages 2
Fixed Packages 2
CVEs 2
Info Packages References Vulnerabilities

A missing permission check in a form validation method in electricflow allowed users with Overall/Read permission to initiate a connection test to an attacker-specified server with attacker-specified username and password.

Additionally, the form validation method did not require POST requests, resulting in a CSRF vulnerability.

This form validation method now requires POST requests and Overall/Administer permissions.

Package Affected Version
pkg:maven/org.jenkins-ci.plugins/electricflow <= 1.1.6
pkg:github/jenkinsci/electricflow-plugin <= 1.1.6
Package Fixed Version
pkg:maven/org.jenkins-ci.plugins/electricflow = 1.1.7
pkg:github/jenkinsci/electricflow-plugin = 1.1.7
ID
JENKINS:SECURITY-1410-1
Severity
medium
Published
2019-06-11T00:00:00
(5 years ago)
Modified
2019-06-11T00:00:00
(5 years ago)
Rights
Jenkins Security Team
Other Advisories
Source # ID Name URL
Plugin repository electricflow repository https://github.com/jenkinsci/electricflow-plugin
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.jenkins-ci.plugins/electricflow org.jenkins-ci.plugins electricflow <= 1.1.6
Fixed pkg:maven/org.jenkins-ci.plugins/electricflow org.jenkins-ci.plugins electricflow = 1.1.7
Affected pkg:github/jenkinsci/electricflow-plugin jenkinsci electricflow-plugin <= 1.1.6
Fixed pkg:github/jenkinsci/electricflow-plugin jenkinsci electricflow-plugin = 1.1.7
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date