1. Home
  2. Security Advisories
  3. Jenkins
  4. JENKINS:SECURITY-1761

[JENKINS:SECURITY-1761] CSRF vulnerability and missing permission checks in `mac`

Severity Medium
Affected Packages 2
Fixed Packages 2
CVEs 2
Info Packages References Vulnerabilities

mac 1.1.0 and earlier does not perform permission checks on a method implementing form validation.
This allows users with Overall/Read access to Jenkins to connect to an attacker-specified SSH host using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

This form validation method requires POST requests and Overall/Administer permission in mac 1.2.0.

Package Affected Version
pkg:maven/org.jenkins-ci.plugins/mac <= 1.1.0
pkg:github/jenkinsci/mac-plugin <= 1.1.0
Package Fixed Version
pkg:maven/org.jenkins-ci.plugins/mac = 1.2.0
pkg:github/jenkinsci/mac-plugin = 1.2.0
ID
JENKINS:SECURITY-1761
Severity
medium
Published
2020-03-09T00:00:00
(4 years ago)
Modified
2020-03-09T00:00:00
(4 years ago)
Rights
Jenkins Security Team
Other Advisories
Source # ID Name URL
Plugin repository mac repository https://github.com/jenkinsci/mac-plugin
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.jenkins-ci.plugins/mac org.jenkins-ci.plugins mac <= 1.1.0
Fixed pkg:maven/org.jenkins-ci.plugins/mac org.jenkins-ci.plugins mac = 1.2.0
Affected pkg:github/jenkinsci/mac-plugin jenkinsci mac-plugin <= 1.1.0
Fixed pkg:github/jenkinsci/mac-plugin jenkinsci mac-plugin = 1.2.0
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date