1. Home
  2. Security Advisories
  3. Jenkins
  4. JENKINS:SECURITY-2536

[JENKINS:SECURITY-2536] CSRF vulnerability and missing permission checks in `embotics-vcommander` allow capturing credentials

Severity Medium
Affected Packages 2
Fixed Packages 2
CVEs 2
Info Packages References Vulnerabilities

embotics-vcommander 1.10 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

embotics-vcommander 2.0 requires POST requests and Overall/Administer permission for the affected form validation methods.

Package Affected Version
pkg:maven/org.jenkins-ci.plugins/embotics-vcommander <= 1.10
pkg:github/jenkinsci/embotics-vcommander-plugin <= 1.10
Package Fixed Version
pkg:maven/org.jenkins-ci.plugins/embotics-vcommander = 2.0
pkg:github/jenkinsci/embotics-vcommander-plugin = 2.0
ID
JENKINS:SECURITY-2536
Severity
medium
Published
2022-02-15T00:00:00
(2 years ago)
Modified
2022-02-15T00:00:00
(2 years ago)
Rights
Jenkins Security Team
Other Advisories
Source # ID Name URL
Plugin repository embotics-vcommander repository https://github.com/jenkinsci/embotics-vcommander-plugin
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.jenkins-ci.plugins/embotics-vcommander org.jenkins-ci.plugins embotics-vcommander <= 1.10
Fixed pkg:maven/org.jenkins-ci.plugins/embotics-vcommander org.jenkins-ci.plugins embotics-vcommander = 2.0
Affected pkg:github/jenkinsci/embotics-vcommander-plugin jenkinsci embotics-vcommander-plugin <= 1.10
Fixed pkg:github/jenkinsci/embotics-vcommander-plugin jenkinsci embotics-vcommander-plugin = 2.0
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date