[JENKINS:SECURITY-982] CSRF vulnerability and missing permission checks in Confluence Publisher Plugin

Severity Medium
Affected Packages 2
Fixed Packages 2
CVEs 1

Confluence Publisher Plugin did not perform permission checks on a method implementing form validation.
This allowed users with Overall/Read access to Jenkins to submit login requests to Confluence using attacker-specified credentials.

Additionally, this form validation method did not require POST requests, resulting in a CSRF vulnerability.

This form validation method now require POST requests and Overall/Administer permissions.

ID
JENKINS:SECURITY-982
Severity
medium
Published
2018-07-30T00:00:00
(6 years ago)
Modified
2018-07-30T00:00:00
(6 years ago)
Rights
Jenkins Security Team
Other Advisories
Source # ID Name URL
Plugin repository confluence-publisher repository https://github.com/jenkinsci/confluence-publisher-plugin
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.jenkins-ci.plugins/confluence-publisher org.jenkins-ci.plugins confluence-publisher <= 2.0.1
Fixed pkg:maven/org.jenkins-ci.plugins/confluence-publisher org.jenkins-ci.plugins confluence-publisher = 2.0.2
Affected pkg:github/jenkinsci/confluence-publisher-plugin jenkinsci confluence-publisher-plugin <= 2.0.1
Fixed pkg:github/jenkinsci/confluence-publisher-plugin jenkinsci confluence-publisher-plugin = 2.0.2
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date
Loading...