[JENKINS:SECURITY-905-2] CSRF vulnerability and missing permission checks in Job Import Plugin allowed capturing credentials

Severity Medium

Affected Packages 2

Fixed Packages 2

CVEs 1

Job Import Plugin did not check user permissions on its API endpoint used to access remote Jenkins instances.
This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Job Import Plugin 3.0 will only access Jenkins instances using credentials defined in the global configuration.

Package	Affected Version
pkg:maven/org.jenkins-ci.plugins/job-import-plugin	<= 2.1
pkg:github/jenkinsci/job-import-plugin-plugin	<= 2.1

Package	Fixed Version
pkg:maven/org.jenkins-ci.plugins/job-import-plugin	= 3.0
pkg:github/jenkinsci/job-import-plugin-plugin	= 3.0

ID

JENKINS:SECURITY-905-2

Severity

medium

Published

2019-01-28T00:00:00
(5 years ago)

Modified

2019-01-28T00:00:00
(5 years ago)

Rights

Jenkins Security Team

Other Advisories

MAVEN:GHSA-57WW-2CVR-WV38

Source	# ID	Name	URL
Plugin repository		job-import-plugin repository	https://github.com/jenkinsci/job-import-plugin-plugin

Type	Package URL	Namespace	Name / Product	Version
Affected	pkg:maven/org.jenkins-ci.plugins/job-import-plugin	org.jenkins-ci.plugins	job-import-plugin	<= 2.1
Fixed	pkg:maven/org.jenkins-ci.plugins/job-import-plugin	org.jenkins-ci.plugins	job-import-plugin	= 3.0
Affected	pkg:github/jenkinsci/job-import-plugin-plugin	jenkinsci	job-import-plugin-plugin	<= 2.1
Fixed	pkg:github/jenkinsci/job-import-plugin-plugin	jenkinsci	job-import-plugin-plugin	= 3.0

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date