1. Home
  2. Security Advisories
  3. Jenkins
  4. JENKINS:SECURITY-995

[JENKINS:SECURITY-995] CSRF vulnerability and missing permission checks in Agiletestware Pangolin Connector for TestRail Plugin allowed overriding plugin configuration

Severity Medium
Affected Packages 2
Fixed Packages 2
CVEs 1
Info Packages References Vulnerabilities

Agiletestware Pangolin Connector for TestRail Plugin did not perform permission checks on an API endpoint used to validate and save the plugin configuration.
This allowed users with Overall/Read access to Jenkins to override the plugin configuration.

Additionally, the API endpoint did not require POST requests, resulting in a CSRF vulnerability.

This API endpoint now requires POST requests and Overall/Administer permissions.

Package Affected Version
pkg:maven/org.jenkins-ci.plugins/pangolin-testrail-connector <= 2.1
pkg:github/jenkinsci/pangolin-testrail-connector-plugin <= 2.1
Package Fixed Version
pkg:maven/org.jenkins-ci.plugins/pangolin-testrail-connector = 2.2
pkg:github/jenkinsci/pangolin-testrail-connector-plugin = 2.2
ID
JENKINS:SECURITY-995
Severity
medium
Published
2018-07-30T00:00:00
(6 years ago)
Modified
2018-07-30T00:00:00
(6 years ago)
Rights
Jenkins Security Team
Other Advisories
Source # ID Name URL
Plugin repository pangolin-testrail-connector repository https://github.com/jenkinsci/pangolin-testrail-connector-plugin
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.jenkins-ci.plugins/pangolin-testrail-connector org.jenkins-ci.plugins pangolin-testrail-connector <= 2.1
Fixed pkg:maven/org.jenkins-ci.plugins/pangolin-testrail-connector org.jenkins-ci.plugins pangolin-testrail-connector = 2.2
Affected pkg:github/jenkinsci/pangolin-testrail-connector-plugin jenkinsci pangolin-testrail-connector-plugin <= 2.1
Fixed pkg:github/jenkinsci/pangolin-testrail-connector-plugin jenkinsci pangolin-testrail-connector-plugin = 2.2
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date