Lucene search

K
githubGitHub Advisory DatabaseGHSA-2MH9-WPGV-7XR8
HistoryMay 13, 2022 - 1:15 a.m.

Jenkins Cloud Foundry Plugin vulnerable to exposure of sensitive information

2022-05-1301:15:21
CWE-862
GitHub Advisory Database
github.com
5
jenkins
cloud foundry
plugin
sensitive information
permission checks
method
form validation
overall/read access
url
credentials ids
cross-site request forgery
post requests
overall/administer
item/configure permissions
global configuration
job configuration
software

CVSS2

4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

41.3%

\Jenkins Cloud Foundry Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this form validation method did not require POST requests, resulting in a cross-site request forgery vulnerability.

This form validation method now requires POST requests and Overall/Administer (for global configuration) or Item/Configure permissions (for job configuration).

Affected configurations

Vulners
Node
org.jenkins-ci.pluginscloudfoundryRange2.3.1
VendorProductVersionCPE
org.jenkins-ci.pluginscloudfoundry*cpe:2.3:a:org.jenkins-ci.plugins:cloudfoundry:*:*:*:*:*:*:*:*

CVSS2

4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

41.3%

Related for GHSA-2MH9-WPGV-7XR8