1. Home
  2. Security Advisories
  3. Jenkins
  4. JENKINS:SECURITY-3256

[JENKINS:SECURITY-3256] CSRF vulnerability and missing permission checks in `neuvector-vulnerability-scanner`

Severity Medium
Affected Packages 2
Fixed Packages 2
CVEs 2
Info Packages References Vulnerabilities

neuvector-vulnerability-scanner 1.22 and earlier does not perform a permission check in a connection test HTTP endpoint.
This allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password.
Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

neuvector-vulnerability-scanner 2.2 requires POST requests and Overall/Administer permission for the affected HTTP endpoint.

Package Affected Version
pkg:maven/org.jenkins-ci.plugins/neuvector-vulnerability-scanner <= 1.22
pkg:github/jenkinsci/neuvector-vulnerability-scanner-plugin <= 1.22
Package Fixed Version
pkg:maven/org.jenkins-ci.plugins/neuvector-vulnerability-scanner = 2.2
pkg:github/jenkinsci/neuvector-vulnerability-scanner-plugin = 2.2
ID
JENKINS:SECURITY-3256
Severity
medium
Published
2023-11-29T00:00:00
(9 months ago)
Modified
2023-11-29T00:00:00
(9 months ago)
Rights
Jenkins Security Team
Other Advisories
Source # ID Name URL
Plugin repository neuvector-vulnerability-scanner repository https://github.com/jenkinsci/neuvector-vulnerability-scanner-plugin
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.jenkins-ci.plugins/neuvector-vulnerability-scanner org.jenkins-ci.plugins neuvector-vulnerability-scanner <= 1.22
Fixed pkg:maven/org.jenkins-ci.plugins/neuvector-vulnerability-scanner org.jenkins-ci.plugins neuvector-vulnerability-scanner = 2.2
Affected pkg:github/jenkinsci/neuvector-vulnerability-scanner-plugin jenkinsci neuvector-vulnerability-scanner-plugin <= 1.22
Fixed pkg:github/jenkinsci/neuvector-vulnerability-scanner-plugin jenkinsci neuvector-vulnerability-scanner-plugin = 2.2
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date