1. Home
  2. Security Advisories
  3. Jenkins
  4. JENKINS:SECURITY-2351

[JENKINS:SECURITY-2351] CSRF vulnerability and missing permission checks in `aws-credentials`

Severity Medium
Affected Packages 2
Fixed Packages 2
CVEs 2
Info Packages References Vulnerabilities

aws-credentials 189.v3551d5642995 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

This form validation method requires POST requests and Overall/Administer permission in aws-credentials 191.vcb_f183ce58b_9.

Package Affected Version
pkg:maven/org.jenkins-ci.plugins/aws-credentials <= 189.v3551d5642995
pkg:github/jenkinsci/aws-credentials-plugin <= 189.v3551d5642995
Package Fixed Version
pkg:maven/org.jenkins-ci.plugins/aws-credentials = 191.vcb_f183ce58b_9
pkg:github/jenkinsci/aws-credentials-plugin = 191.vcb_f183ce58b_9
ID
JENKINS:SECURITY-2351
Severity
medium
Published
2022-03-15T00:00:00
(2 years ago)
Modified
2022-03-15T00:00:00
(2 years ago)
Rights
Jenkins Security Team
Other Advisories
Source # ID Name URL
Plugin repository aws-credentials repository https://github.com/jenkinsci/aws-credentials-plugin
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.jenkins-ci.plugins/aws-credentials org.jenkins-ci.plugins aws-credentials <= 189.v3551d5642995
Fixed pkg:maven/org.jenkins-ci.plugins/aws-credentials org.jenkins-ci.plugins aws-credentials = 191.vcb_f183ce58b_9
Affected pkg:github/jenkinsci/aws-credentials-plugin jenkinsci aws-credentials-plugin <= 189.v3551d5642995
Fixed pkg:github/jenkinsci/aws-credentials-plugin jenkinsci aws-credentials-plugin = 191.vcb_f183ce58b_9
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date