[JENKINS:SECURITY-866] CSRF vulnerability and missing permission checks in Black Duck Detect Plugin allowed server-side request forgery, capturing credentials

Severity Medium
Affected Packages 2
Fixed Packages 2
CVEs 1

Black Duck Detect Plugin did not perform permission checks on methods implementing form validation.
This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins, and to cause Jenkins to submit HTTP requests to attacker-specified URLs.

Additionally, these form validation methods did not require POST requests, resulting in a CSRF vulnerability.

These form validation methods now require POST requests and Overall/Administer permissions.

ID
JENKINS:SECURITY-866
Severity
medium
Published
2018-06-04T00:00:00
(6 years ago)
Modified
2018-06-04T00:00:00
(6 years ago)
Rights
Jenkins Security Team
Other Advisories
Source # ID Name URL
Plugin repository blackduck-detect repository https://github.com/jenkinsci/blackduck-detect-plugin
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.jenkins-ci.plugins/blackduck-detect org.jenkins-ci.plugins blackduck-detect <= 1.4.0
Fixed pkg:maven/org.jenkins-ci.plugins/blackduck-detect org.jenkins-ci.plugins blackduck-detect = 1.4.1
Affected pkg:github/jenkinsci/blackduck-detect-plugin jenkinsci blackduck-detect-plugin <= 1.4.0
Fixed pkg:github/jenkinsci/blackduck-detect-plugin jenkinsci blackduck-detect-plugin = 1.4.1
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date
Loading...